FortiAuthenticator Usage Profile Not running

[ismailurek2]

Hello, 

I want to limit the VPN connection of local or imported ldap user as data and time using usage profile on FortiAuthenticator. I am listening on 1646 radius acconting. 1646 port is open on FortiGate and FortiAuthenticator. When the user exceeds the specified limit, no warning and interruption is observed. Can anyone realize this application or have any suggestions? By the way, when the user connects, I cannot see any session in Monitor > Radius Session field.

I have followed all the warnings in this document:

https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-Usage-Profiles-not-enforced-for-R...

[ebilcari]

Firstly you can run a packet capture in FAC to verify that indeed the Accounting messages are reaching FAC. Later you can check from the debugs, https://fac/debug/ [Accounting Monitor] logs to get a better overview on what is happening.

[ismailurek2]

Hi @ebilcari ,

When I look at the accounting monitor, I get an invalid error in this way. I do not have information about which field to apply the secret I set for accounting on the FortiGate side on the FortiAuthenticator side.

[ebilcari]

The secret for accounting messages should be the same as the one used for authentication, remember to also enable this toggle:

[ismailurek2]

Hi @ebilcari ,

We did it the way you described, but there was no solution.

In the document I mentioned above, the hashes of the secret parts on the FortiGate side look different. Could the equivalent of secret be in a different place in FortiAuthenticator?

Regards

[ebilcari]

The hashes will appear different in FGT even when the same secret is used. Try to set the same secret for accounting again. I did a quick test in the lab and the configuration went straight forward (SSLVPN user):

[ismailurek2]

Hi @ebilcari,

In the current case with Fortinet TAC, they had the same problem as us and they are now trying to solve it. Secret was entered the same and when tested it did not work again. Do you have the possibility to share your configurations related to Radius and usage profile?

Regards

[ismailurek2]

@ebilcari Hello,

That's how we got a response from TAC. As far as I understand, by design, there is no disconnection after exceeding the quota in this way. Could I have been misdirected?

"I found that by design, there won't be any disconnect message/action if the user exceeds the quota whilst it is connected.

This is not a software issue you're dealing with. If you need this to be changed, please discuss with your Sales Rep the prospect of a feature/change request.

Once the user exceeded the quota, shouldn't be allowed to connect anymore after it disconnects. That is how this feature works.
It is unclear from the docs if this should work with sslvpn also, or it only works with captive portal."

Regards