Authenticate FortiAP via FortiGate to RADIUS with computer certificates

[asapHO]

Hi Community,

I'm stuck with a Problem that I cannot solve - maybe someone can help me out.

SCENARIO:

Using Wireless LAN within a corporate Environment and authenticate users with certificates

GOAL:

Using FortiAPs controlled by a FortiGate to authenticate Computers with their Computer certificate against an existing Windows NPS (Radius) implementation.

First of all - I do have a working LANCOM deployment within our Environment which works exactly like it is supposed to be.

So we have a working Windows Enterprise CA and a working NPS deployment.

I can authenticate with the FortiGate Unit against our RADIUS Server (FortiGate says it is working) - so I've activated the WiFi Controller Feature and linked two FortiAP321C Units. I've created a SSID with a local Bridge to the fortiAPs Interface. Selected WPA2 Enterprise and the Radius Server I've configured.

I cannot get the Windows Clients to authenticate (using the same NPS Profile like the LANCOM APs) with the FortiAP and I don't know what the Problem might be. Using the "old" LANCOM structure (with similar Settings) it is working like a charm (but I have to mention, that in a LANCOM deployment every AP is querying the RADIUS Server). So Computers get their certificates automatically from our Enterprise CA and the RADIUS Server validates them and grants Access.

I haven't found a cookbook mentioning this Scenario so has anybody built this and can help me out?

Any Feedback is appreciated!

Thanks and best regards...

[Mike_FTNT]

Hi,

Could you please do "show user radius" in your FGT and then test its connectivity?

For example:

FW90DP3Z14003488 (root) # show user radius config user radius     edit "PEAP"         set server "172.16.200.33"         set secret ENC ... ...     next end FW90DP3Z14003488 (root) # diagnose test authserver radius PEAP mschap2 tester 123456 authenticate 'tester' against 'mschap2' succeeded, server=primary assigned_rad_session_id=781115654 session_timeout=0 secs idle_timeout=0 secs!

Please also show your SSID configuration.

>> Computers get their certificates automatically from our Enterprise CA and the RADIUS Server validates them and grants Access.

Haven't those computers (or WiFi stations?) saved their client certificates as well as the CA in local hard drive already, before associate with the SSID?

Is EAP-TLS used as WiFi authentication method by them?

Thanks,

Mike

[ciscomemo]

asapHO wrote:

Hi Community,

I'm stuck with a Problem that I cannot solve - maybe someone can help me out.

SCENARIO:

Using Wireless LAN within a corporate Environment and authenticate users with certificates

GOAL:

Using FortiAPs controlled by a FortiGate to authenticate Computers with their Computer certificate against an existing Windows NPS (Radius) implementation.

First of all - I do have a working LANCOM deployment within our Environment which works exactly like it is supposed to be.

So we have a working Windows Enterprise CA and a working NPS deployment.

I can authenticate with the FortiGate Unit against our RADIUS Server (FortiGate says it is working) - so I've activated the WiFi Controller Feature and linked two FortiAP321C Units. I've created a SSID with a local Bridge to the fortiAPs Interface. Selected WPA2 Enterprise and the Radius Server I've configured.

I cannot get the Windows Clients to authenticate (using the same NPS Profile like the LANCOM APs) with the FortiAP and I don't know what the Problem might be. Using the "old" LANCOM structure (with similar Settings) it is working like a charm (but I have to mention, that in a LANCOM deployment every AP is querying the RADIUS Server). So Computers get their certificates automatically from our Enterprise CA and the RADIUS Server validates them and grants Access.

I haven't found a cookbook mentioning this Scenario so has anybody built this and can help me out?

Any Feedback is appreciated!

Thanks and best regards...

Hi,

I am also interested in an 802.1x deployment with FGT and fortiap , I have checked the latest fortigate document but cant seem to find a section of this . I believe this feature is not documented by fortigate even though its supported and because of lack of documentation I am unsure to which extent is this supported and what are the limitations . In such cases I would need to do a hit and test couple of times before bringing up a successful implementation .

please correct me if i am wrong. 

[asapHO]

Hi community,

I'll have a fortinet tech guy here next week and we'll see whether we will find a solution.

@Mike_FTNT - RADIUS Authentication with MSCHAP is working out of the box, so radius seems to be configured correctly. For EAP/TLS - every Computer gets a certificate enrolled via Group policy.

To be more precise - this way of authentication is already working with a LANCOM deployment - this is about replacing the LANCOM deployment with FortiAPs and I assume (based on the suspect, that the LANCOM solutions is working) that the Windows NPS Radius is configured correctly (and yes, the shared secret is working and the fortigate is in the range to query the NPS).

I'm looking forward to see the fortinet tech guy - maybe he knows how to do that...

best regards - will Report back ;)

[Bromont_FTNT]

[link]https://stuff.purdon.ca/?page_id=49[/link]

[asapHO]

@Bromont_FTNT - This link did the trick! I've already had set everything in place but the Authentication Methods allowed in EAP Modes had only the method "certificates" activated. So I've added MSCHAPv2 and now this is working like a charm.

I wonder why the other method is working fine with Lancom and I also dare to ask: Isn't a pure CERTIFICATE ONLY Method not a little bit more secure than MSCHAPv2 Username and Password?

But thanks for that link - working on Server 2012R2 NPS (with implemented Enterprise CA Infrastructure) with FortiOS 5.2.4

Thanks to all Readers ;)

best regards