Radius with MAG2600 UAC device

[jbrunk]

Hello everyone,

My radius device is a MAG2600(UAC) My Firewall Is a Fortigate 100D, I am having a hard time getting radius setup for admin login into the FW itself. 

I know my issue is more so on the MAG2600 and the VSA dct file i have to manually configure.

This is what Fortinet provides which doesn't work at all.

VENDOR Fortinet 12356 BEGIN-VENDOR Fortinet ATTRIBUTE Fortinet-Group-Name 1 string ATTRIBUTE Fortinet-Client-IP-Address 2 ipaddr ATTRIBUTE Fortinet-Vdom-Name 3 string ATTRIBUTE Fortinet-Client-IPv6-Address 4 octets ATTRIBUTE Fortinet-Interface-Name 5 string ATTRIBUTE Fortinet-Access-Profile 6 string # # Integer Translations # END-VENDOR Fortinet

THis is what i created and it seems to be working. as i am now able to see these options under the Radius attributes section.

@radius.dct

# # Fortinet specific parameters #

MACRO Fortinet-VSA(t,s) 26 [vid=12356 type1=%t% len1=+2 data=%s%]

[style="background-color: #ffff00;"]ATTRIBUTE Fortinet-Group-Name Fortinet-VSA(1, string) r (This is the one i have setup on the Fortigate)[/style] ATTRIBUTE Fortinet-Client-IP-Address Fortinet-VSA(2, ipaddr) r ATTRIBUTE Fortinet-Vdom-Name Fortinet-VSA(3, string) r ATTRIBUTE Fortinet-Client-IPv6-Address Fortinet-VSA(4, octets) r ATTRIBUTE Fortinet-Interface-Name Fortinet-VSA(5, string) r ATTRIBUTE Fortinet-Access-Profile Fortinet-VSA(6, string) r

I guess my biggest Questions has anyone been able to get this to work? if so do they have a config for the MAG and Fortigate they can share with me? 

Thanks.

[xsilver_FTNT]

Hello,

inserted "Fortinet-VSA" does seems to me as your MAG server specific modification of usual RADIUS dictionary structure.Structure as at the beginning does seems to be exactly what's published by Fortinet as dictionary. It's kind of standard structure used by other vendors and also by FreeRADIUS AFAIK.

However requirements of your MAG server might differ, check documentation for MAG.

Regarding how to setup FortiGate with RADIUS admin auth seems to me pretty straightforward.

For examples check kb.fortinet.com and search for "radius admin" "radius group match" and similar keywords.

Or check Authentication guide on docs.fortinet.com

Kind regards, Tomas

[jbrunk]

The fix is in the MAG2600 Radius.dct File this is the Defualt the MAG2600 provides, you need to add

line#362  MACRO MS-VSA(t,s) 26 [vid=311 type1=%t% len1=+2 data=%s%] line#363 OPTION bundle-vendor-id=311

Once this is done then the Fortinet DCT file will work correctly.

James Brunk

[xsilver_FTNT]

not sure about used vendor id as Fortinet's is 12356 , but anyway, you made it working !

[jbrunk]

This is what the Fortinet.dct file should look like

############################################################# # # Fortinet specific parameters # # MACRO Fortinet-VSA(t,s) 26 [vid=12356 type1=%t% len1=+2 data=%s%] # ATTRIBUTE Fortinet-Group-Name Fortinet-VSA(1,string) cr ATTRIBUTE Fortinet-Client-IP-Address Fortinet-VSA(2,ipaddr) cr ATTRIBUTE Fortinet-Vdom-Name Fortinet-VSA(3,string) cr ATTRIBUTE Fortinet-Client-IPv6-Address Fortinet-VSA(4,hexadecimal) cr ATTRIBUTE Fortinet-Interface-Name Fortinet-VSA(5,string) cr ATTRIBUTE Fortinet-Access-Profile Fortinet-VSA(6,string) r

This setup with the other addition i posted here will allow the Fortinet to radius to a UAC Pulse secure device