FortiADC L7 RADIUS APPLICATION FROFILE AND COA

[MarcoMerlo]

Hi to all,

I noticed that on a L7 Radius Application profile one can switch on "Dynamic Auth" option a configure a destination port for COA.

I am wondering if such a configuration option  could be useful to handle COA "back requests " from a node of the radius pool towards a radius client. Suppose that a on the network switch or a wireless controller the ip address of the Radius VIP is both configured as AAA server and COA authorized ip address. I was wondering whether the "Dynamic Auth" switch purpose was to apply source nat to COA requests coming from any of the radius servers in the pool .   On our current F5 bigip LTM I use a forwarding virtual ip address listening on the COA port to source nat COA requests from the radius servers so that  Radius Clinet receives COA packests having the radius VIP as source address.

BR

MM

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

[Anthony_E]

Hello Marco,

To configure an L7 RADIUS application profile with Change of Authorization (CoA) on FortiADC, follow these steps:

1. Client Address and Source Port:

   • Decide whether to use the original client IP address and port as the source when connecting to the real server. By default, these are set to "Off."

2. Timeout RADIUS Session:

   • Set the session timeout for RADIUS. The default is 300 seconds, but you can configure it between 1 and 3,600 seconds.

3. Dynamic Authorization (CoA):

   • Enable or disable Dynamic Authorization for RADIUS CoA. By default, this is disabled.

4. Dynamic Auth Port:

   • Configure the UDP port for CoA requests. The default port is 3799.

5. Geo IP Blocklist and Allowlist:

   • Configure Geo IP blocklist and allowlist as needed. By default, these are set to "None."

Ensure that the predefined RADIUS profile LB_PROF_RADIUS is configured according to your requirements, with the default settings as mentioned above.