RADIUS FortiGate - RSA Authentication Manager

[Thonno]

Hi,
I'm configuring a FortiGate 400F for VPN authentication via RADIUS with RSA Authentication Manager, but I can't get access to VPN/Admins via groups to work.
(If I create a Firewall group that reads all RADIUS it works, but if I create a Firewall group that matches a single  RADIUS group it doesn't work)

I've configured the Firewall side:
config user radius
edit "RSA-ARLUNO"
set server "x.x.x.x"
set secret .....
set radius-coa enable
set radius-port 1812
next
end

The group is configured as follows:
config user group
edit "Utenti_VPN_RSA"
set member "RSA-ARLUNO"
config match
edit 1
set server-name "RSA-ARLUNO"
set group-name "Utenti_VPN_RSA"
next
end
next
end

On the RSA Authentication Manager side, I created the Radius Client, the Radius Agents and added the Fortinet VSAs.

If I create a RADIUS profile on RSA that always returns the value "Fortinet-Group-Name" - Utenti_VPN_RSA works, but it has to be a dynamic field.

Can someone help me out?

[saleha]

Hi Thonno,

Thank you for reaching out. This requires troubleshooting and investigating deeper on both the RSA authentication manager and the fortigate. I recommend openning a ticket with support if applicable for better and quicker assistance. In general and based on what you mentioned that without specifying a group on the radius server the authentication works, troubleshooting steps are:

1- make sure you are configuring the right fortinet VSA - Vendor Specific Attribute- on the Authentication manager. For list of fortinet VSA:
https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/952303/radius-avps-and-vsas#...

2- If all config is confirmed correct next step is to run radius authentication debug on the fortigate:

diag de app radiusd -1

diag de app fnbamd 255

diag de console time en

diag de enable

3- Run a packet capture on the fortigate using gui "Network>Diagnostics" or from cli using a sniffer:

diag sniffer packet any "host x.x.x.x or port <dst port>" 6 0 l

Note: in case of running a sniffer you will need to convert the output to a pcap file to be able to view it in wireshark or other network analysis tools. Check the below link on how to manually convert the sniffer output to pcap:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-import-diagnose-sniffer-packet-data...

4- check the logs on the authentication manager to find out if the radius challenge was rejected or discarded for any reason.

Thank you,

saleha

[hbac]

Hi @Thonno,

To match specific group name, please refer to the following links: 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-define-group-based-authorization/ta...

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/710485/restricting-radius-us...

Regards,

[Shashwati]

Please reconfirm the user group on your Radius server that it is matching the user correctly . If without using any specific group it works it indicate there is mismatch on Radius group information 

[pminarik]

> If I create a RADIUS profile on RSA that always returns the value "Fortinet-Group-Name" - Utenti_VPN_RSA works, but it has to be a dynamic field.

This sounds like the FortiGate-side of the configuration just works.

You need to figure out how to configure the RADIUS server so that it sends the appropriate Fortinet-Group-Name string for the appropriate user/group.

In something like FortiAuthenticator this is quite easy: You create a group that matches some LDAP filter (=members of group X), add the desired RADIUS attribute to this group (to be sent if the LDAP filter=membership matches), then include this group in the RADIUS policy for the RADIUS client.

I would assume you will need to do something similar, assuming your RADIUS server references an LDAP-like back-end database to find out who is a member of what.