Hi
I am getting an issue when trying to authenticate a device using radius. I have exported the certificate for a user but according to logs they do not exist or cannot be found.
802.1x authentication failed: user not found
It seems to work perfectly for users synced across AD.
What am I missing?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
You don't give enough detail such as where the failing user is stored (local DB?) and if they can authenticate without 802.1x e.g. directly via RADIUS auth. Without more details, I would start to debug as follows:
[ul]Also going to https://<FAC_IP>/debug/radius/ to look at the extended logs (enable "Enter Debug Mode" for verbose logging but remember to disable after use).
Dr. Carl Windsor Field Chief Technology Officer Fortinet
The failed user is a local user stored locally on the fortiauthenticator itself.
We have a remote sync rule to sync across users from AD and these seem to work without a problem. I wouldve though a user created locally would work far more easily.
The realm is setup for local users. The realm is also added to the radius clients but not as default. It is added as the second option.
I've gone into the logs but cannot see an option for enter debug mode.
>I've gone into the logs but cannot see an option for enter debug mode.
Sounds like you may be running an old build. Which version are you running?
Dr. Carl Windsor Field Chief Technology Officer Fortinet
v3.00-build0060-20140612-patch00
This is a very old release (16 months) and there have been a large number of developments and fixes in this area. I would recommend upgrading to a later release (4.0) and retrying.
*Backup your config first of course.
FAC 4.1 is imminent (next few days) so you may want to hold fire for this release.
Carl
Dr. Carl Windsor Field Chief Technology Officer Fortinet
The below is the log output. It appears to be trying to search through ldap. If i create an account on AD for ipadtest it seems to work. How do i get it to search local accounts? The realm under the client section in the radius section seems to have the "Allow local users to override remote users" tick box greyed out for local realm. There is an LDAP realm but that has the groups filtered to exclude this user group.
===>Username:ipadtest 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: ===>NAS IP:172.18.3.1 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: Realm: (null) (default realm id: 3) username: ipadtest 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: Realm not specified, default goes to remote LDAP, id: 1 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: Loaded remote ldap (regular bind) 172.16.100.25:389 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: Try to search user by: (&(objectClass=person)(sAMAccountName=ipadtest)) 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: ERROR: fac_ldap_search() failed: number of entries: 0 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: # Executing group from file /usr/etc/raddb/sites-enabled/default 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: Updated auth log 'tipadtest': 802.1x authentication failed: user not found 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: Waking up in 0.9 seconds. 2016-04-08T14:34:55+01:00 FortiAuthenticator radiusd[21665]: Waking up in 4.9 seconds. 2016-04-08T14:35:00+01:00 FortiAuthenticator radiusd[21665]: Ready to process requests. 2016-04-08T14:35:06+01:00 FortiAuthenticator radiusd[21665]: # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
Did you set Realm: Local | Local Users in the RADIUS Client Config (Authentication > RADIUS Service > Clients)?
Dr. Carl Windsor Field Chief Technology Officer Fortinet
Yes thats set.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1698 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.