FortiNAC with Huawei AC6508 WLC

[AEK]

Hello

We integrated Huawei AC6508 WLC with FortiNAC, using local RADIUS, but we facing some issue.

• When we set Default Attribute Group to RFC_VLAN we notice in RADIUS logs that FortiNAC sends the right response to the WLC, however the WLC still asks the user to authenticate, like it the WLC didn't recognize the RADIUS response
• When we set Default Attribute Group to None we notice that the WLC put the authenticated user in the default service VLAN, so it works

So I guess the that the predefined RFC_VLAN Attribute Group is not the good one to use with our WLC.

In the FortiNAC document "Huawei Controller Wireless Integration" guide they mentioned to leave the value "None" optionally, but in our case we need to include the target VLAN in the RADIUS response.

Any idea on what should be the attributes of the right Attribute Group to use?

[ndumaj]

Hi,

What is the FNAC firmware version?
What is the guide you have followed?
Please review this guide:
https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/51126d1c-4672-11ed-9d74-fa163e...

BR

[AEK]

Hello

It is FortiNAC 9.2.8.

The guide I followed is the one you shared above.

[ndumaj]

Hello,
I would review the WLC integration first.
This is the radius attribute that FNAC sends:

Why is the WLC complaining, is the WLC receiving this RFC?
There should be a log from WLC why is rejecting this RFC?
What does the WLC expect to have as a response?

BR

[AEK]

Hi

Indeed these are the good questions.

Thanks for the hint.. I'll check and comeback.

[ndumaj]

I guess the WLC log should provide more information to understand the issue.

BR

[Sheikh]

Hi,

A packet capture on both the FortiNAC and wireless controller, might also give some insight.

In addition to that, following debugs on FortiNAC would also give more details.

nacdebug -name RadiusManager true

nacdebug -name RadiusAccess true

go to the logs folder and tail the output.master file.

Don't forget to disable debugging after troubleshooting.

regards,

Sheikh

[AEK]

Hello

I found that the issue is in %ACCESS_VALUE%.

In fact the access value (Tunnel-Private-Group-ID) sent by FortiNAC's RADIUS to Huawei WLC is "VLAN 0015".

I tried to force force the Tunnel-Private-Group-ID to just "15" and it worked.

In model configuration FortiNAC lists the VLANs in this format: "VLAN 0015", so I guess it is sending this value as RADIUS response.

When FortiNAC reads the VLANs from the WLC, it takes the "VLAN name" as value, not VLAN ID, while on WLC I left the declared VLANs unnamed.

The default name "VLAN 00##" is shown by the WLC when there is no given name, then on VLAN assignment by FNAC's RADIUS, the same default name is not recognized by the WLC itself.

The solution was just to give a name to each VLAN.

Declaring the VLANs like this will not work "vlan batch 20 100 102". We must give a name to each VLAN in order to make it work. FortiNAC will use the assigned name as %ACCESS_VALUE" and WLC will recognize it.

[ndumaj]

Hello AEK,
Thank you for your update,
Definitely the WLC doesn't understand the "VLAN 00##" - VLANID format it prefers to have the VLAN only :)

GOOD job!
Well DONE!