Need Sample Config – FortiGate NAC Lite + FortiAuthenticator + Intune (EAP-TLS)

[nflnetwork29]

I’m setting up EAP-TLS for Entra-joined devices using FortiGate NAC Lite (7.4.x) and FortiAuthenticator (6.6.x) with certs deployed via Intune SCEP.

I’ve got it mostly working but need a known-good config to compare against—especially:

• FortiAuthenticator SCEP & RADIUS settings

• FortiGate 802.1X interface config

• Any Intune SCEP profile tips

If anyone can share a working example or config snippet, it’d be a huge help.
Thanks!

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[ebilcari]

I think the tag that is used is not the right one, this integration is not related to FortiNAC (as a product) but related to FortiGate and FortiAuthenticator.

[Anthony_E]

Thank you Emirjon.

I have modified the tags accordingly.

Regards.

[nflnetwork29]

Hello any updates other than changing tags?

[Anthony_E]

Hi,

Modifying the tags will help to find users who can provide help.

They will help ASAP.

Regards,

[nflnetwork29]

Symptoms:

• Windows Event Viewer logs:

  • Event ID 309: “Certificate enrollment failed. Error: 0x80070057 – The parameter is incorrect”

  • Event ID 32: SCEP request returns HTTP error (0x80190194 = 404 Not Found)

• FortiAuthenticator Web Service logs:

  • Log ID 8819:
    SCEP GetCA: Failed to retrieve requested CA, returning default CA certificate CN=CA.DOMAIN.com

[Markus_M]

Hi,

from the description I have to assume, you have Intune as SCEP client, FortiAuthenticator as SCEP server.
SCEP is an HTTP based protocol, so HTTP logic applies (with its response codes).

First, see to reproduce an SCEP request at will and then check the logs at that time when you reproduced the issue. The logs that you shared from FortiAuthenticator are not relevant because it says that the client didn't specify which CA to return, so FortiAuthenticator returned the default one.

Your client logs say that FortiAuthenticator responded with an HTTP code 404, which is that the resource cannot be found because the requested resource does not exist. As the 404 and the FortiAuthenticator log do not match, check what the client is requesting that FortiAuthenticator answers with 404.

I don't see this as related, the CA certificate message will not return a 404 but a HTTP 200 with the CA certificate that is sent to the client.

FortiAuthenticator listens at /app/cert/scep/.

The client should make a GetCACaps request, gets a response.
Client makes a CA request, gets a response (which you log says is happening).
Client should then ask to have a certificate signed (that log will be interesting)

Your "Failed to retrieve requested CA" proves that it answers on it the link and the GetCACaps seems OK. After this, the client is supposed to make a certificate request to the FortiAuthenticator which in turn should be visible in packet capture and logs.
Debug logs can of course help and are found at https://fac-ip/debug/scepd

I don't have a sample config for Intune, but for FortiAuthenticator and certmonger:
https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-Example-of-use-of-certmonger-and/...
In the link you can see debugs, that show the same error message you posted, but it has no relation to the function as the default CA is good.

Tip:

On FortiAuthenticator create a wildcard enrollment for test with no subject matching, to avoid issues with that for now. Add these when the rest of enrollment is working with the wildcard.

Quick guess, ignoring the 404. The SCEP client must trust the CA and needs to have its public CA installed in its trust store. You may have then issues in the Intune log about untrusted certificate as a result of the CA certificate that is returned.

Best regards,

Markus

[nflnetwork29]

So you have no samples of a working setup that leverages Microsoft Intune?

[Anthony_E]

Thanks a lot!