FG 60F fails to proceed CoA request

[SC_Alex]

Hello, 

I faced a problem, that some time ago stopped working CoA Disconnection
If I do: 
echo "User-Name=Username, Framed-IP-Address=10.0.0.X" | radclient -x name.fortidyndns.com:3799 disconnect Secret

The router receives packet on wan interface, i see it with packet capture tool on port 3799
L4 Length 43 Checksum 0xb86a

But not performs anything. 

On LocalIn Policy I see that 

Custom Application UDP any 3799 Accept

On corresponding wan port Radius accounting is enabled. Plus it was working few days ago. 

I suppose it could get broken after I put both wan interfaces into SD-WAN, but not sure. 
On 2nd device FG-61F there is same thing happens. Both have version 7.4.3

config user radius
edit "Radius"
set server "y.y.y.y"
set secret Secret
set nas-ip x.x.x.x
set acct-interim-interval 60
set radius-coa enable
set auth-type pap
set acct-all-servers enable
config accounting-server
edit 1
set status enable
set server "y.y.y.y"
set secret Secret
set port 1813
set source-ip "x.x.x.x"
next
end
next
end

Any ideas how to diagnose / fix this are highly appreciated

[SC_Alex]

We used Framed-IP-address & username 
We can see them in Dashboard - Firewall User Monitor
And with such string it worked well for some time:
echo "User-Name=Username, Framed-IP-Address=10.0.0.X" | radclient -x name.fortidyndns.com:3799 disconnect Secret

[ebilcari]

If it worked in the past it means that the attributes are accepted by FGT.

In the packet capture you see this requests as:

Disconnect-Request: radius.code == 40

or
CoA Request: radius.code == 43

Does this domain (name.fortidyndns.com) resolve to the FGT NAS IP configured under RADIUS configuration?

[SC_Alex]

Pcap on FG see this packet, but it is not processed by FG and there is no any reply from FG on this packet (earlier if something was wrong it sent Disconnect-NAK, if ok - Disconnect-ACK):
Source IP IP1
Source Port 39176
Destination IP IP2
Destination Port 3799
Protocol UDP
L4
Length 43
Checksum 0x9fa6


Also I removed both wan ports from SD-WAN, with zero result 

[SC_Alex]

Seems like the problem is wider: 
FG does not accepts any packets, even if we try sending CoA request from internal interface (LAN). 

It also see incoming packet but FG does nothing with it, not replies at all. 
I'm confused. 

[SC_Alex · Accepted solution]

The problem is solved.
It was in test enviroinment. We have changed password for client (client.conf):
client 192.168.1.20 {
ipaddr = 192.168.1.20
secret = testing123
coa_server = {
secret = testing124
port = 3799
}
}

But connection test in FG showed ok with old passwords was kept for authentication and accounting, so this caused bad checks of this part from our side.

Meanwhile seems like coa password is received by FG from RADIUS server when they exchange auth/accounting information (not sure exactly which one). And only with this password disconnection works well. So after we updated secret for radclient, it became fully functional again. 

I would suggest adding more detailed description of coa functionality to FG docs.