Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
gattac
New Contributor

7.2.10 Breaks DUO Radius proxy

We have a few customers who use the DUO Radius proxy to provide 2fa for the VPN. After an automatic update to 7.2.10 the user receives the DUO prompt, but authentication never completes. There is a known bug int the release notes about radius not working in the UI, and the workaround is to use the CLI to test authentication, but not that it would break any actual functionality.

For now we have rolled back to 7.2.9 but just wanted to give a heads up.

omegle xender
13 REPLIES 13
saleha
Staff
Staff

Hi gattac,

 

Thank you for reaching out. I assume this is relevant to changes done on 7.2.10 to mitigate against a radius vulnerability as described on release notes here:
https://docs.fortinet.com/document/fortigate/7.2.10/fortios-release-notes/5880/radius-vulnerability

 

You can try RADSEC which is tls authentication. An example to such deployment is on the following link:

https://docs.fortinet.com/document/fortigate/7.4.5/administration-guide/729374/configuring-a-radsec-...

 

Thank you,

saleha

Toshi_Esumi
SuperUser
SuperUser

@saleha 
Even feroz_ftnt's comment in this reddit thread is not clear. 
https://www.reddit.com/r/fortinet/comments/1fnrpf8/fortigate_200f_radius_response_fails_after/

Is this a problem triggered by FortiOS 7.2.10 started attaching Message-Authenticator(80) attribute and Duo doesn't reply with the correct attribute value after re-calculation, or just doesn't reply?
Or is this FortiOS 7.2.10's bug miscalculating the replied value from Duo?

The FGT GUI issue described in the thread has to be a separate issue only for the testing method because that doesn't involves actual user authentication incomplete.

Toshi

amuda
Staff
Staff
Toshi_Esumi

@amudaSo are you saying Duo is not set up properly to replying to FGT's Auth Request with Message-Authenticator attribute (80) , or in other words the Duo server side is ignoring the attribute? I'm asking this because the KB is stating below:
"To fix this, enable the message-authenticator attribute on the third-party RADIUS server to include on its RADIUS messages."

And, @gattac Can you confirm this is indeed the fact? To confirm, you have to go back to 7.2.10 again after changing the setting, whatever it is, on the Duo side though. 


Toshi

pminarik

Given that Duo are currently handwaving the issue away (for perfectly valid reasons IMO), I think it's safe to assume they don't utilize Message-Authenticator at all and thus the new FortiOS versions will reject their replies. Otherwise I see no reason why they wouldn't just happily confirm that they're already capable of dealing with this attack vector.

[ corrections always welcome ]
jokes54321
New Contributor III

Fortinet sure put us in a very bad position on this one. Upgrade the firmware on 70+ firewalls to 7.2.10, and FortiAuthenticator 6.6.2, all in the same evening, so we don't cause random outages across the company. 

 

They should have implemented backward compatibility into Authenticator 6.6.2, to allow us time to upgrade the firewalls before enforcing this. 

Toshi_Esumi

I tend to agree to @jokes54321 's idea although I don't blame FTNT to implement this Message-Authenticator attribute now while this is an industry standard by now and all others have done this already, except Duo and a few other RADIUS server providers.

FortiOS could have provide an exception flag, "legacy RADIUS server", in the RADIUS configuration so that the server can be excluded from the "mandatory" Message-Authenticator attribute check, which freeRADIUS exactly did with their newer release as I described in my post:
https://community.fortinet.com/t5/Support-Forum/RADIUS-attribute-Message-Authenticator/td-p/327120
so that they can accept like old FortiOS as a client when it didn't send the attribute.

The developers(volunteers) put a little more thoughts on this when they introduced the version including this mandatory attribute. Smarter.

Toshi

Toshi_Esumi
SuperUser
SuperUser

So my conclusion for this issue based on last a couple of days of research over this community posts and Reddit posts, only solution with 7.2.10/7.4.5 or newer versions that would come out in the future is to set Duo Auth proxy to bypass Message-Authenticator attribute or all attributes to/from a backend auth server like Windows NPS/AD since Duo proxy itself doesn't support the attribute or TLS/RadSec at this moment.
https://help.duo.com/s/article/9014?language=en_US
https://help.duo.com/s/article/8930?language=en_US

Toshi

saleha
Staff
Staff

Hi Toshi_Esumi,

I hope the following clears up the information:
- FortiOS 7.2.10, 7.4.5 and future release 7.6.1 also require message-authentication attribute in radius setup with udp or tcp

- RADSEC or TLS is a way around this however it is currently not supported on DUO

- I have looked up DUO page and can only find them referencing pass-through options that includes message-authentication as provided at the following pages:
https://help.duo.com/s/article/7537?language=en_US
https://help.duo.com/s/article/9014?language=en_US

- I am not sure if the above articles apply to all kind of setup or just DUO proxy setup

- DUO according to the following announcement are actively investigating into allowing RADSEC authentication yes:

https://help.duo.com/s/article/8932?language=en_US

 

Thank you,

saleha

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors