Radius and syslog fails

[kevin001]

Hai my client uses a separate interface for mgmt 

Syslog, radius servers are behind another port on the firewall.

the  source ip and interface ip mentioned is the mgmt interface and ip and its required for them,

But no syslog is being send. also radius connectivity fails.

There is a policy that allows traffic from management interface to the server port allowing syslog and radius.

[rosatechnocrat]

This is an local-out traffic, and does not pass via normal Firewall policy. It uses configured local in-traffic policies. 

you need to enable ha-direct if the firewall is in a HA group. Check more details below. 

config system ha

set ha-direct enable

end

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Sending-messages-logs-SNMP-RADIUS-directly...

[kevin001]

Thanks for the reply,the firewalls are in ha and dedicated mgmt is not selected , will this suggested command above is applicable

set hbdev "ha" 0 "port16" 0 
set session-pickup enable
set override disable
set priority 255
set group-name ....

[Shashwati]

Hello

To get more information regarding Radius fails, use the following CLI commands:

diagnose debug enable
diagnose debug application fnbamd 255

To stop this debug type:

diagnose debug application fnbamd 0

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-troubleshootin...

[mpeddalla]

Hello  @kevin001 ,

Thank you for contacting the Fortinet Forum portal.

Can you confirm before this behavior are there any firmware upgrades ?

what is the current firmware on the FortiGate device?

As mentioned by @rosatechnocrat the traffic for syslog is self-generated it doesn't fully relay on the firewall policy itself.

Please verify the configuration for Syslog :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-syslog-communication-for-HA-setu...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Override-HA-member-syslog-and-FortiAnalyze...

Best regards,

Manasa.

If you feel the above steps helped resolve the issue, mark the reply as solved so that other customers can get it easily while searching for similar scenarios.

[kevin001]

Dear Manasa

This is a new setup with two FortiGate firewalls in HA mode, Dedicated for management is not configured in HA. One interface is separately allocated for management with ip.

Syslog and ISE are connected to servers in port three, and the management ip is on port 1.

The firmware version is 7.2.9

We find while enabling syslog, it uses the interface ip facing Syslog server as the source

also for ISE source ip is the interface facing the server.

We need to check the possibility of the firewall using port 1 management ip as a source for ISE and syslog.

Also, I request another piece of advice regarding FSSO: if a user-based policy is also required instead of groups in FSSO, what kind of agent/collector setup is advised, as collector-only setup helps with group-based policy only it seems.

Thank you