FG 60F fails to proceed CoA request

[SC_Alex]

Hello, 

I faced a problem, that some time ago stopped working CoA Disconnection
If I do: 
echo "User-Name=Username, Framed-IP-Address=10.0.0.X" | radclient -x name.fortidyndns.com:3799 disconnect Secret

The router receives packet on wan interface, i see it with packet capture tool on port 3799
L4 Length 43 Checksum 0xb86a

But not performs anything. 

On LocalIn Policy I see that 

Custom Application UDP any 3799 Accept

On corresponding wan port Radius accounting is enabled. Plus it was working few days ago. 

I suppose it could get broken after I put both wan interfaces into SD-WAN, but not sure. 
On 2nd device FG-61F there is same thing happens. Both have version 7.4.3

config user radius
edit "Radius"
set server "y.y.y.y"
set secret Secret
set nas-ip x.x.x.x
set acct-interim-interval 60
set radius-coa enable
set auth-type pap
set acct-all-servers enable
config accounting-server
edit 1
set status enable
set server "y.y.y.y"
set secret Secret
set port 1813
set source-ip "x.x.x.x"
next
end
next
end

Any ideas how to diagnose / fix this are highly appreciated

[adambomb1219]

What is the RADIUS server?   Why are you sending RADIUS over the WAN?  Is it over an IPSec tunnel I hope?  What is the CoA for?  Managed switch?  Managed AP?  FortiClient SSL VPN?

[SC_Alex]

It is freeradius. 
It is a test config, so we use WAN now. 
CoA is for router, it has to disconnect clients connected via Firewall Group. 
They are connected via wifi ap, in a dedicated vlan. 
I tested without SD-WAN, result is the same. 

[AEK]

Did you say in your first post it worked before you configure SD-WAN or it actually doesn't work without SD-WAN?

[SC_Alex]

It worked without SD-WAN, then we added SD-WAN and in some moment it stopped working, not sure that after adding SD-WAN

Now I removed SD-WAN on 1 router and it is still not working as expected 

Router receives packet and nothing happens

[ebilcari]

You have to check that after the interface/routing changes, same IP is used and there is no NAT applied, RADIUS communication using different IP will get ignored both from NAS or the server.

To get more details for the CoA you can enable this debug on FGT:

diag debug app radius-das 8

[SC_Alex]

I enabled this and closed cli, but can't find how to check the results

[ebilcari]

The output will come on the CLI in real time, you have to also enable the debugs with:

diag debug enable

and this command to record also the timestamps (if needed to crosscheck)

diag debug console timestamp enable

[SC_Alex]

No, nothing in console 

[ebilcari]

Are you using a valid CoA generated from the RADIUS server for a connected host (using the MAC address) or you are trying to emulate this CoA packet?

It's recommended to use an actual authenticated host for the tests.