EAP-TLS request not reaching FAC

[TheOnlyJames]

Client laptop has a cert issued by Microsoft AD (via Intune) the Trusted CA has been imported to the FAC 6.6.0 as per this video:

EAP-TLS Authentication with FortiAuthenticator | Identity and Access Management

The fortigate is set to use the FAC / WPA2 Enterprise as per the instructions, everything is configured as per the fortinet website, but nothing gets sent to the FAC (other traffic using SSL VPN is fine, so its not a connection issue)

Running debugs and logs on both the FAC and the Gate, the EAP-TLS request is not even reaching the FAC, 

Fortigate logs show:

2024-11-06 15:09:28 05768.944 70:32:17:11:01:7a <eh> IEEE 802.1X (EAPOL 14B) ==> 70:32:17:11:01:7a ws (0-10.16.152.100:5246) rId 0 wId 1 38:c0:ea:a0:d0:81 2024-11-06 15:09:28 05768.974 70:32:17:11:01:7a <eh> IEEE 802.1X (EAPOL 5B) <== 70:32:17:11:01:7a ws (0-10.16.152.100:5246) rId 0 wId 1 38:c0:ea:a0:d0:81 2024-11-06 15:09:28 05768.974 70:32:17:11:01:7a <eh> recv IEEE 802.1X ver=1 type=1 (EAPOL_START) data len=0

Which show a pattern link below

auth-req

auth-resp

reassoc-req

reassoc-resp

client-disconnected

This then repeats, client machine shows the same sort of log, I have configured and had it checked by TAC, and still cannot get this simple connection working, any help from here is appreciated,

[Hatibi]

Are you testing wireless or conneting wired to a Switchport?

The logs you have shared have this message as last one before disconnection:

<eh> recv IEEE 802.1X ver=1 type=1 (EAPOL_START) data len=0

At this point the Authenticator (AP/switch) should send an Identity request packet to get the Host. That is why you see nothing in FortiAuthenticator. That part comes after the identity request/response phase is completed.

So the issue is to be investigated between the Supplicant(endpoint) and the Authenticator.

It might be an issue with 802.1x settings on the Authenticator. 

[TheOnlyJames]

So, this wireless, Client > AP > Fortigate > FAC

The Fortigate is set to use FAC as the Radius Server with WPA2 enterprise. So the issue is likely the AP? that just broadcasts the SSID , could you elaborate please?

[Hatibi]

Yes the problem is at this communication channel between Client <> AP 

Check the 802.1x setting in the AP and check its debugging if it shows any more details on why there is no EAP identity Request packet sent back.

The flow is the following:

Supplicant ---- EAPOL START ----> AP

Supplicant <---- EAP Identity Request ---- AP

Supplicant ---- EAP Identity Response ----> AP

                                                                     AP --------- Radius Acess-Request ------> FAC

[TheOnlyJames]

I have configured everthing as per 

EAP-TLS Authentication with FortiAuthenticator | Identity and Access Management

When the client clicks connect to the SSID, we get 

"Unable to connect because you need a certificate to sign in" but I have the cert on the client machine, and the FAC has the ROOT CA that signed it! Help anyone?

[Hatibi]

Are you using User or Computer certificates?

Is the certificate present in the certificate store in Personal > Certificates ?

Is the certificate created with usage for "Client Authentication"

[TheOnlyJames]

Hi, its just a client cert , it has the machine name as its subject, so I'm guessing computer? and it is present in the laptop personal certificate store, the certifcate is issued by the organisations AD, I have the Organisations ROOT CA that signed it on the FAC

[Hatibi]

In the video you have shared, the configuration setting on the supplicant is set to: "Use simple certificate selection (Recommended)"

With that option, windows will perform the following:

a) Automatically select a certificate for authentication without user interaction (if possible)

or b) will show a dropdown for the user to select a certificate.

Reference link

If you get that error it means windows cannot find a client certificate to use. It is not recognizing that you have the cert in the personal store.

It could be an issue with the certificate type or some attribute.

Can you share the certificate details?

[TheOnlyJames]

I cant really,  but it is issued

to: machinename.org.net

issued by: org Issuing CA 02

It is valid,

SAN = machinename.org.net

the org Issuing CA 02 cert is present on the FAC as a trusted CA

[sjoshi]

Hi,

It seems like the EAP-TLS request from the client laptop is not reaching the FortiAuthenticator (FAC) despite proper configuration. The FortiGate logs indicate the EAPOL messages being exchanged but not reaching FAC. The pattern of authentication request and response loops along with client disconnection suggests a communication issue. Since SSL VPN traffic is working fine, it's not a connectivity problem. To troubleshoot further, ensure the EAP server certificate and Trusted CA are correctly configured on FAC, verify the RADIUS settings on both FAC and FortiGate, and check for any firewall rules blocking the EAP-TLS traffic. Additionally, reviewing the detailed logs on FAC using the debug interface and analyzing the network traffic with tools like Wireshark on UDP port 1812 can help pinpoint where the communication breakdown is occurring.