FortiWifi Authentication and PMK Caching

[heyyo]

Hi Team,

Is there a way to clear the cached PMK for the FortiWifi authentication connection? This is to ensure that when end devices reconnect to the network, it will be forced to reauthenticate and not us cached data.

Can confirm that the setting for the existing Lifetime of the PMK-R0 key can be set in:

config wireless-controller vap

set ft-r0-key-lifetime < integer>

Is there a way to see the sessions related to this? and also clear this?

Thank you!

[Jean-Philippe_P]

Hello heyyo, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[Jean-Philippe_P]

Hello again Heyyo,

I found this solution. Can you tell me if this helps, please?

To ensure that end devices are forced to reauthenticate and not use cached data, you can manage the PMK-R0 key lifetime and clear sessions as needed. Here's how you can do it:

1. Set the PMK-R0 Key Lifetime:
   - You can configure the PMK-R0 key lifetime using the command: ` config wireless-controller vap set ft-r0-key-lifetime <integer> `
   - This setting determines how long the PMK-R0 key is valid before it expires, forcing reauthentication.
   
   
2. View and Clear Sessions: To view and clear sessions, you can use the FortiSwitchOS commands to manage authorized sessions. Although the context does not provide specific commands for viewing PMK-R0 sessions, you can clear authorized sessions using the following methods:
   Using the GUI:
   - Go to `Switch > Interface > Physical`.
   - Select the ports you want to clear the authorization from.
   - Select `Clear Auth`.
   
   Using the CLI:
   - To clear sessions associated with an interface: ` execute 802-1x clear interface {internal | <port_name>} ` Example: ` execute 802-1x clear interface port3 `
   - To clear sessions associated with a MAC address: ` execute 802-1x clear mac <MAC_address>'.
   
   

These steps will help ensure that devices reauthenticate when reconnecting to the network.