Radius connection does not work anymore after upgrading from 7.2.9 to 7.2.10

[martinsc]

Hello everybody,

I have upgraded my FGT60F today from 7.2.6 to 7.2.9 and then to 7.2.10
This has been working fine without any issue.

After a while I noticed, that the VPN-Clients were not able to connect anymore.
When I inspected the Radius Server Connection (freeradius), it says:

Connection status: credentials not valid 

I tried a few settings, whether I will get the connection back - but this did not work.

After changing back to 7.2.9 the connection with the radius server worked again.

Any ideas, what the problem could be?

Thanks,
Martin

[AEK]

Hi Martin

This is due to a new RADIUS vulnerability.

https://www.fortiguard.com/psirt/FG-IR-24-255

If I'm not wrong the solution is to use RADSEC.

[AEK]

Additionally you may check this:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-failure-after-...

[martinsc]

Thanks for your quick answer!
Martin

[Toshi_Esumi]

Hold on. I had the opposite experience, it didn't work when FGT was 7.2.9 and the freeRADIUS was upgraded to the latest. So I had to exempt the FGT from Message-Authenticator attribute check as I posted before.
https://community.fortinet.com/t5/Support-Forum/RADIUS-attribute-Message-Authenticator/td-p/327120

So do you have this "require_message_authenticator = no" flag set? I would assume it would still work with 7.2.10 with this exception. Or you might need to upgrade the freeRADIUS to the latest.

Toshi

[Toshi_Esumi]

But your error is different from my case. Does it fail if you create a new user/set a new credential and try connecting VPN? Run "radiusd -X" to check the detail when it fails.

Toshi