Radius Authentication

[amitkor]

Hello everyone!

Can anyone help with configuring Radius authentication for VPN on fortigate 5.2.1?

I want to handle all the users on the Radius server.

When i configure a policy with a single radius user, i connect to the vpn just fine.

When i configure a group with radius as the remote authentication, i get wrong password (log: sslvpn_login_permission_denied). even when i add the same single user to that group i get the same error.

The Radius server is a Windows Server 2012 with NPS enabled. the remote server has the exact same group name as in the windows server.

I did read a bit about Radius SSO and thought that this is what i need, but after creating RSSO, it does not appear as a source user under ssl.root interface (it does appear under other interfaces).

Regards,

Amit K.

[Jeff_FTNT]

RSSO is different from local Radius server authentication.

If you want use Windows 2012 server for RSSO, make sure it send Radius Accounting packet to FGT, FGT will check "framed-ip" attribute and set up authentication for specific user IP.

You may check detail RSSO doc on http://docs.fortinet.com/fortigate/admin-guides. Thanks