Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
SC_Alex
New Contributor III

FG 60F fails to proceed CoA request

Hello, 

I faced a problem, that some time ago stopped working CoA Disconnection
If I do: 
echo "User-Name=Username, Framed-IP-Address=10.0.0.X" | radclient -x name.fortidyndns.com:3799 disconnect Secret

The router receives packet on wan interface, i see it with packet capture tool on port 3799
L4 Length 43 Checksum 0xb86a

But not performs anything. 

On LocalIn Policy I see that 

Custom Application UDP any 3799 Accept

On corresponding wan port Radius accounting is enabled. Plus it was working few days ago. 


I suppose it could get broken after I put both wan interfaces into SD-WAN, but not sure. 
On 2nd device FG-61F there is same thing happens. Both have version 7.4.3

config user radius
edit "Radius"
set server "y.y.y.y"
set secret Secret
set nas-ip x.x.x.x
set acct-interim-interval 60
set radius-coa enable
set auth-type pap
set acct-all-servers enable
config accounting-server
edit 1
set status enable
set server "y.y.y.y"
set secret Secret
set port 1813
set source-ip "x.x.x.x"
next
end
next
end

Any ideas how to diagnose / fix this are highly appreciated

1 Solution
SC_Alex
New Contributor III

The problem is solved.
It was in test enviroinment. We have changed password for client (client.conf):
client 192.168.1.20 {
ipaddr = 192.168.1.20
secret = testing123
coa_server = {
secret = testing124
port = 3799
}
}


But connection test in FG showed ok with old passwords was kept for authentication and accounting, so this caused bad checks of this part from our side.

Meanwhile seems like coa password is received by FG from RADIUS server when they exchange auth/accounting information (not sure exactly which one). And only with this password disconnection works well. So after we updated secret for radclient, it became fully functional again. 

I would suggest adding more detailed description of coa functionality to FG docs. 

View solution in original post

14 REPLIES 14
SC_Alex
New Contributor III

We used Framed-IP-address & username 
We can see them in Dashboard - Firewall User Monitor
And with such string it worked well for some time:
echo "User-Name=Username, Framed-IP-Address=10.0.0.X" | radclient -x name.fortidyndns.com:3799 disconnect Secret

ebilcari

If it worked in the past it means that the attributes are accepted by FGT.

In the packet capture you see this requests as:

Disconnect-Request: radius.code == 40

or
CoA Request: radius.code == 43

Does this domain (name.fortidyndns.com) resolve to the FGT NAS IP configured under RADIUS configuration?

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
SC_Alex
New Contributor III

Pcap on FG see this packet, but it is not processed by FG and there is no any reply from FG on this packet (earlier if something was wrong it sent Disconnect-NAK, if ok - Disconnect-ACK):
Source IP IP1
Source Port 39176
Destination IP IP2
Destination Port 3799
Protocol UDP
L4
Length 43
Checksum 0x9fa6


Also I removed both wan ports from SD-WAN, with zero result 

 

SC_Alex
New Contributor III

Seems like the problem is wider: 
FG does not accepts any packets, even if we try sending CoA request from internal interface (LAN). 

 

It also see incoming packet but FG does nothing with it, not replies at all. 
I'm confused. 

SC_Alex
New Contributor III

The problem is solved.
It was in test enviroinment. We have changed password for client (client.conf):
client 192.168.1.20 {
ipaddr = 192.168.1.20
secret = testing123
coa_server = {
secret = testing124
port = 3799
}
}


But connection test in FG showed ok with old passwords was kept for authentication and accounting, so this caused bad checks of this part from our side.

Meanwhile seems like coa password is received by FG from RADIUS server when they exchange auth/accounting information (not sure exactly which one). And only with this password disconnection works well. So after we updated secret for radclient, it became fully functional again. 

I would suggest adding more detailed description of coa functionality to FG docs. 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors