Problem authenticating with radius on 100D

[lohelle]

I' m having problem authenticating my SSL-VPN against radius. I have a Fortigate 100D, v4.0,build0535,120511 (MR3 Patch 7) I have a radius server called " duosec" with primary server IP 10.130.1.2 and key " xxxxxxxx" (the key is 8 chars) Authentication scheme on " use Default.." , but have tried all VPN login does not work. In the log I see the following Action: ssl-login-fail Reason: no_matching_policy The strange thing is when I run diag from CLI. diag test authserver radius-direct 10.130.1.2 -1 xxxxxxxx lohelle password Result: 0: OK As you see this is working. But when I try this: diag test authserver radius duosec pap lohelle password (also tried chap, mschap and mschap2) Result: authenticate ' lohelle' against ' pap' failed, assigned_rad_session_id=48824321 session_timeout=0 secs! Is this a bug? I do not understand why radius-direct works, but not " radius definedserver"

[Matthijs]

What do you see in the radius server logs? Are you sure you need pap to authenticate? Can you paste the output of the following command (on the cli)

 config user radius
 show
 

[lohelle]

I have tried all the auth types (chap, pap, mschap and mschap2) Output: config user radius edit " duosec" set secret ENC HT3gOVPEeHEYSqCvfFnsFb7sm0EWamMyWeSzJx1pPqhaBBJqyL6L7fbBMAwMyK7V8ajmlKJqtokfdAup4JAAvxAYXvxs4HkZATT7FLfIvR9OGoCV set server " 10.130.1.2" next end Actually, when I check the radius log I see that the user is rejected even if the response is 0: OK (Same message as when trying the other diag command) from log: Login attempt for username u' lohelle' Improperly-formatted password: Invalid Password Returning response code 3: AccessReject Sending response

[lohelle]

I have tried changing to a password with just letters, and tried with reversible password encryption for the user account. I use Duo Security Auth Proxy as radius-server, but I also tried MS IAS.

[Matthijs]

Did you try changing the shared secret? The error seems to be clear but can also be about the secret. It seems you are using freeradius. How did you configure it? Are you sure the IP address used by the fortigate to connect to the radius server is the same as you have allowed in the freeeradius server?

[lohelle]

Tried a different secret now. Will try some other client than Fortigate and check the logs then.

[lohelle]

ok. Found the problem. The Duo security proxy expected password,sms or password,push , and then I get a push request to approve the login. I need to adjust the timeout btw, because I do not have enough time to respond before the login is rejected.