Authentication Failure Radius Server showing Can't contact radius server

[amitrohilla07]

Hello Team,

We have HA device both devices are login via Radius server, however we are facing issue with secondary firewall not able to login it shows Authentication Failure but on primary firewall we can be able to login the firewall without any issue. as of now workaround we are using that reboot the secondary firewall and after that it works fine but after couple of days issue raise again showing Authentication Failure. we tried to use set source-ip but nothing worked only solution we can afford as of now REBOOT.

Can you please look into this serious issue 

Thanks

[funkylicious]

hi,

are you using radius for FGT management / admin access or for remote access for users?

[amitrohilla07]

We are using for firewall management / admin access. we only face this issue when we try to login on secondary firewall. primary firewall works fine and able to access via radius authentication. 

[funkylicious]

do you manage them via a in-band/out-band management ip address and is that ip address/source-ip configured on the radius server as a client ?

what does the logs say on the radius server when trying to access the 2nd device ?

[amitrohilla07]

In-band management IP of the lan interface IP and same IP configured as client in Radius server. i tried to packet-capture but no traffic found in pcap. i only saw 169.254.1.2 ip communication.

[funkylicious]

that's strange.

i am using a similar setup with FortiAuth as radius server and I can log in both devices using the in-band ip address and my username+pwd+token ( as defines in the radius policy ) . in there i can see the source ip, the cluster ip address and not the individual/in-band management

[amitrohilla07]

Hello Team,

can someone please check into this, we can discuss this issue it is having in many devices like FortiGate 100F 200F and many more. Radius server we have Cisco ISE.

[funkylicious]

hi,

this is a best effort forum type of help that anyone here can provide, based on experience and encountered situations.

if the matter is urgent, i would suggest opening a Fortinet TAC case and they will do the best to help resolve your issue.

[amitrohilla07 · Accepted solution]

Fortinet has officially confirmed this is a known bug affecting all FortiGate devices. The issue is recorded with engineering and is expected to be resolved in version 7.4.9, scheduled for release in September 2025.

Current Workaround

1. Login to the secondary FortiGate using admin credentials
2. Identify the PID of the fnbamd process by running
   diagnose sys process pidof fnbamd
3. Kill the process using:
   diagnose sys kill 11 <PID>
   Replace <PID> with the actual process ID (e.g., 2456)Please note the PID will be changing evry time to please check PID very firstly before running kill command..
   Example:-

   

[Markus_M]

A shorter way, less commands:
fnsysctl killall -11 fnbamd
Do you have that bug ID?