FortiAuthenticator and Radius Admin access on Cisco SG-500X

[Alex_talmage]

Hi All,

I was wondering if anybody had any luck configuring Radius admin authentication to the Cisco SG-500 switches, or for that matter any of their "Small-Business" line?

So far I have the switch configured as a Radius Client in FortiAuth, filtered down to a remote LDAP group. This works perfectly for allowing the login, but unfortunately the group members get privilege level 1, ie they have then elevate permissions using the Enable password.

The old FortiAuth3.3 Interoperability Guide talks about configuring the FortiAuth to send Radius Attributed of "Cisco-AVPair = shell:priv-lvl=15" and "Service-Type = NAS-Prompt-User" to elevate permissions to priv levl 15 which bypasses Enable. (pg 44 - http://docs.fortinet.com/uploaded/files/1991/fortiauthenticator-two-factor-authentication-interopera...) I cannot get this to work. I have found other forum posts that state the service-type needs to be "Administrative-User" but still no dice. My concern is that a packet capture shows that the Accept-Accept packet coming back from the FortiAuth doesn't even included these Radius Attributes!

Strictly speaking, the small-business switches from Cisco are not running iOS that you would find on the Catalyst switches. In particular, I think the missing aaa authorization commands may be what I'm missing, but I'm concerned that I'm not even seeing the Radius Attributes being sent back to the Cisco Switch?

Any help would be much appreciated.

[Carl_Windsor_FTNT · Accepted solution]

Just in case, I tested to verify that the Attributes are being sent and they are being sent correctly (tested for User and Group Attributes in FAC 4.1.1 (0081).  Note there was an issue in 4.1.0 where if an LDAP filter was used to pull users in, group attributes would not be sent.  Upgrade and retry if this is the case.

Looking at the Cisco documentation for the SG-500 the correct attributes should be:

Service-Type = Administrative-User
Cisco-AVPair = "shell:priv-lvl=15"

Carl

[Carl_Windsor_FTNT · Accepted solution]

Just tested and I know what the issue is.  To get the group attributes to be sent, you have to define a filter and add the group to the filter in the RADIUS Service > Clients setting.  This is deliberate as it allows you to send different group attributes depending on the Client you are authenticating to.

Try this and let me know how you get on.

[Carl_Windsor_FTNT · Accepted solution]

Correct.  If you set a remote user a FAC Administrator, they can no longer be added to a group.  You can see this if you try to add the user manually to the group; the user no longer appears in "Available LDAP users" to move across.

Carl

[Alex_talmage]

Out of interest, what is the reasoning behind that? Is it not quite common for FAC admins to be administrators of other areas of the infrastructure?

[Carl_Windsor_FTNT · Accepted solution]

IIRC, the technical reason was down to how the user passwords are stored (when users are local).  Admin passwords are securely hashed and not reversible which is required to support PAP used some 802.1x methods.  For this reason they were precluded from being used in some methods.  This limit was also applied to remote users for consistency .

I will investigate further to see if there is technical reason why this is still the case or if we can lift it and allow the required behavior.

[Alex_talmage]

Thank you for your help Carl, happy we've got to the bottom of it. Going forward I think we are going to use an "Admin" account for FAC, and our unique admin accounts for all other systems.

Very impressed with your help.

[Carl_Windsor_FTNT]

Thank you Sir.  For your reference, after testing this further, I have raised this as a bug rather than a feature request as I found some inconsistent/unexpected behavior.  This is being tracked under BugID 0381154 so watch the release notes for this reference.

[polra]

To add RADIUS attributes to a user or group:

[ol]

Go to Authentication > User Management > Local Users and select a user account to edit, or go to Authentication > User Management > User Groups and select a group to edit.

In the RADIUS Attributes section, select Add Attribute. The Create New User Group RADIUS Attribute or Create New User RADIUS Attribute window opens.

Select the appropriate Vendor and Attribute ID, then enter the attribute’s value in the Value field.

Select OK to add the new attribute to the user or group.

Repeat the above steps to add additional attributes as needed.

[/ol]

https://docs.fortinet.com/document/fortiauthenticator/6.0.0/administration-guide/704851/user-managem....