Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Radius Authentication


I know that this topic was already discussed in the forum, but the solution did not solved my issue. I have a problem with the RADIUS authentication from a FG100F to a NPS Windows Server. When I try to authenticate I get this error:

"AVP: l=22 t=Vendor-Specific(26) v=Microsoft(311) VSA: l=16 t=MS-CHAP-Error(2) Value: '<00>E=691 R=0 V=3'"

But I don't know if this error comes from the FG or from the NPS server.


The thing is, I have already a FG which is connected to the same RADIUS server and with this firewall it works. But when I connect another FG to the same RADIUS, it doesn't. 

So I guess the new firewall must be allowed somewhere in the NPS to make authentication requests.

Had someone other this problem as well, and maybe a solution?

Thank you!!!!!!




In the RADIUS server you have to add the RADIUS clients (NAS), in this case the IP of the FGT. Pay attention to the source IP that FGT uses for these requests, if it's a different source IP (or NATed) the requests will be dropped. You can also specify the source IP when you configure the RADIUS server in FGT as  the NAS IP.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.

Please refer to below guide on how to deploy Microsoft NPS (RADIUS). Please check if steps 1 - 5 is configured properly.

You may also refer to below guide on how to troubleshoot, RADIUS authentication from Fortigate

Best Regards,

Arnold Dimailig
TAC Engineer
New Contributor

Hi all, I'm a little bit closer to the solution. :)

It is possible to authenticate now against the Radius server. I get also a phone call from Microsoft because of MFA. This works so far. But after or during the authentication process I get this error when I try to authenticate via CLI on the FG:


authenticate '' against 'mschap2' failed(no response), assigned_rad_session_id=1373936999 session_timeout=0 secs idle_timeout=0 secs!


And in the Fortigate GUI there is the message in the Radius config: Can't contact Radius server. After the auth. process has been finished, FG is able to connect the Radius server again.


So authentication works, but it immediately closes the connection.


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors