Creation of Custom VSA

[robinh007]

We are planning to utilize a RADIUS server for LDAP and OTP authentication. Our objective is to send the Username, Password, and OTP in a single request. To achieve this, we need to create a Custom Vendor-Specific Attribute (VSA) in the FortiGate firewall. This will enable us to include the OTP along with the Username and Password for authentication purposes. Could you please provide the detailed procedure for creating a Custom VSA in the FortiGate firewall?

FortiGate 

[Stephen_G]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[dingjerry_FTNT · Accepted solution]

Hi @robinh007 ,

I am unfamiliar with Radius and have never heard of including a Username, Password, and OTP in one Radius request.

Here is the article about Fortinet's RADIUS Dictionary and VSAs (latest):

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Fortinet-s-RADIUS-Dictionary-and-VSAs-late...

[AEK]

I think it depends on the authentication protocol (PAP, CHAP, MSCHAP2 & EAP). Some support challenge response, some support concatenated password-OTP and some may support both.

[robinh007]

We have defined the protocol as PAP in our radius server. 

[AEK]

PAP is insecure but it supports password-token concatenation.