RADIUS VSA questions

[VicAndr]

When you configure RADIUS authentication you import the following VSAs into RADIUS server: ############################## VENDOR Fortinet 12356 BEGIN-VENDOR Fortinet ATTRIBUTE Fortinet-Group-Name 1 string ATTRIBUTE Fortinet-Client-IP-Address 2 ipaddr ATTRIBUTE Fortinet-Vdom-Name 3 string ATTRIBUTE Fortinet-Client-IPv6-Address 4 octets ATTRIBUTE Fortinet-Interface-Name 5 string ATTRIBUTE Fortinet-Access-Profile 6 string # While there is a knowledge base article on FortiNet which clearly explains how to import VSAs into RADIUS (IAS on Windows 2003) there is nothing that explains VSAs themselves and what firewall does with the attributes when it receives them. So there is a room for different interpretations of the attributes and as a result RADIUS authentication configuration problems. Fortinet-Group-Name 1 string - what group name do you specify here? The group name on firewall which relies on RADIUS authentication or RADIUS group name an authenticating user belong to? If the groups names on a FortiGate and on RADIUS are the same than you can' t go wrong but what if they are different? Fortinet-Client-IP-Address 2 ipaddr - what IP address we are talking about here? Is it IP address of interface FortiGate directly communicates to RADIUS server or it is IP address of interface FortiGate receives users authenticating requests from? Fortinet-Vdom-Name 3 string - that one seems to be obvious: we specify VDOM name where authentication takes place. Fortinet-Client-IPv6-Address 4 octets - same as the second attribute. It might become even more complicated if we take into consideration the fact that wireless access points involved into RADIUS authentication have different IP addresses on their physical and virtual interfaces. Fortinet-Interface-Name 5 string - most likely that must be interface name FortiGate receives client' s authenticating request from. Fortinet-Access-Profile 6 string. I have absolutely no idea what you would put here. One might think that if there is a policy which relies on RADIUIS authentication with above mentioned user group you would specify it here. But what if there are multiple policies which use the same authentication group? Example in " Importing FortiGate VSAs into Windows 2003 Server" (see above mentioned artickle) doesn' t use this attribute at all. Is it because this attribute is irrelevant or simply because the example in the artickle it it too old and doesn' t reflect requirements of FortiOS 4.0? Thank you for any comments. VA

[cordfox]

Did you ever find answers to your questions? I have RADIUS auth working although I am unable to specify a Group Name.

[MisterAG]

I have a working NPS RADIUS server passing group membership back to a FortiSSL: 1. Create a new Network Policy (Network Policy and Access Services > NPS > Policies > Network Policies > New • Name: VPN-Example • Type of network access server: Unspecified • Conditions: Windows Groups - G_VPN-Example (This is the Windows Group that the user belongs to • Access Permission: Access Granted • Authentication Methods: MS-CHAP-V2, MS-CHAP, PAP & SPAP • Configure Constraints: NONE 2. In the Configure Settings window, we can now set RADIUS Vendor Specific Attributes • RADIUS Attributes - Vendor Specific > Add • Vendor-Specific Attribute Information - Enter Vendor Code: 12356 (This is the vendor code for Fortinet) • Yes. It conforms • Configure Attribute • Vendor assigned attribute number: 1 • Attribute format: String • Attribute value: VPN-Example (This value will need to be matched on the Fortinet User Group configuration) • OK • Configure a second attribute • Vendor assigned attribute number: 3 • Attribute format: String • Attribute value: root (This value represents the VDOM that the RADIUS Session will terminate on. If you don' t know what a VDOM is, then it is root) On the Fortigate Side: config user radius edit " RADIUSServer" set secret mysecret set server RADIUSServer.DNSZone.local set auth-type pap (or whatever your RADIUS Server is running) end config user group edit " VPN-ExampleGroup" set sslvpn-portal " VPN-ExamplePortal" set member " RADIUSServer" config match edit 1 set server-name " RADIUSServer" set group-name " VPN-Example" (this is the part that matches the VSA attribute #1 end end

[praving]

How do we test radius authentication on Forti manager using CLI command ?

I have one command but it is not working on forti manager. 

"diagnose test authserver radius-direct <server_name or IP> <port number> <secret>"

Please share us exact command.

[emnoc]

You replied to a old thread 

So the cmd is not working or the result are not passing? Have you  run an packet captures at the  FMG and whatever RADIUSserver? What does the  RADIUS server log shows (e.g wrong secret , faiil-auth ,etc...)

Have you  validate the  authentication type of the client PAP CHAP MS-CHAP,etc............

Ken