Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
SC_Alex
New Contributor III

FG 60F fails to proceed CoA request

Hello, 

I faced a problem, that some time ago stopped working CoA Disconnection
If I do: 
echo "User-Name=Username, Framed-IP-Address=10.0.0.X" | radclient -x name.fortidyndns.com:3799 disconnect Secret

The router receives packet on wan interface, i see it with packet capture tool on port 3799
L4 Length 43 Checksum 0xb86a

But not performs anything. 

On LocalIn Policy I see that 

Custom Application UDP any 3799 Accept

On corresponding wan port Radius accounting is enabled. Plus it was working few days ago. 


I suppose it could get broken after I put both wan interfaces into SD-WAN, but not sure. 
On 2nd device FG-61F there is same thing happens. Both have version 7.4.3

config user radius
edit "Radius"
set server "y.y.y.y"
set secret Secret
set nas-ip x.x.x.x
set acct-interim-interval 60
set radius-coa enable
set auth-type pap
set acct-all-servers enable
config accounting-server
edit 1
set status enable
set server "y.y.y.y"
set secret Secret
set port 1813
set source-ip "x.x.x.x"
next
end
next
end

Any ideas how to diagnose / fix this are highly appreciated

1 Solution
SC_Alex
New Contributor III

The problem is solved.
It was in test enviroinment. We have changed password for client (client.conf):
client 192.168.1.20 {
ipaddr = 192.168.1.20
secret = testing123
coa_server = {
secret = testing124
port = 3799
}
}


But connection test in FG showed ok with old passwords was kept for authentication and accounting, so this caused bad checks of this part from our side.

Meanwhile seems like coa password is received by FG from RADIUS server when they exchange auth/accounting information (not sure exactly which one). And only with this password disconnection works well. So after we updated secret for radclient, it became fully functional again. 

I would suggest adding more detailed description of coa functionality to FG docs. 

View solution in original post

14 REPLIES 14
adambomb1219
SuperUser
SuperUser

What is the RADIUS server?   Why are you sending RADIUS over the WAN?  Is it over an IPSec tunnel I hope?  What is the CoA for?  Managed switch?  Managed AP?  FortiClient SSL VPN?

SC_Alex
New Contributor III

It is freeradius. 
It is a test config, so we use WAN now. 
CoA is for router, it has to disconnect clients connected via Firewall Group. 
They are connected via wifi ap, in a dedicated vlan. 
I tested without SD-WAN, result is the same. 

AEK

Did you say in your first post it worked before you configure SD-WAN or it actually doesn't work without SD-WAN?

AEK
AEK
SC_Alex
New Contributor III

It worked without SD-WAN, then we added SD-WAN and in some moment it stopped working, not sure that after adding SD-WAN

Now I removed SD-WAN on 1 router and it is still not working as expected 

Router receives packet and nothing happens

ebilcari
Staff
Staff

You have to check that after the interface/routing changes, same IP is used and there is no NAT applied, RADIUS communication using different IP will get ignored both from NAS or the server.

To get more details for the CoA you can enable this debug on FGT:

diag debug app radius-das 8

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
SC_Alex
New Contributor III

I enabled this and closed cli, but can't find how to check the results

ebilcari

The output will come on the CLI in real time, you have to also enable the debugs with:

diag debug enable

and this command to record also the timestamps (if needed to crosscheck)

diag debug console timestamp enable

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
SC_Alex
New Contributor III

No, nothing in console 

ebilcari

Are you using a valid CoA generated from the RADIUS server for a connected host (using the MAC address) or you are trying to emulate this CoA packet?

It's recommended to use an actual authenticated host for the tests.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors