Using a second Radius Server through VPN

[gcarvalho]

Hello

We have an environment with two sites: Site A and site B. Both sites have a Fortigate in the edge.

There is a Site-to-Site VPN between this two sites.

We'd like to configure in the Fortigate from site B a NPS Server that is in the site A (through VPN). Is that possible? I have tried to do that, but the NPS Server is showed as offline in the Site's B Fortigate and never goes up to online.

In the site A, the NPS Server is showed online and is working fine.

Is there any configuration that I have to set to the Site's B Fortigate communicate with the NPS Server in the other side of the VPN?

The subnet where the NPS is placed is in the "crypto map" of the VPN and there is a policy allowing the communication.

Thanks in advanced.

[Debbie_FTNT · Accepted solution]

Hey gcarvalho,

you also need to consider that the source IP setting in RADIUS server applies to the entire server entry.
-> if you add the NPS B as secondary RADIUS server, and define a source IP, FortiGate will use this source IP for NPS A as well, so be careful with setting one

-> as Toshi and Kayzie mentioned, you will likely need some kind of source IP setting to allow FortiGate A to send traffic to NPS B via IPSec successfully

-> you might want to consider assigning IPs to the tunnel interfaces themselves instead of setting a source IP in the radius server entry (would need to be done on both sides)

[Toshi_Esumi]

First, you need to make the server IP reachable from the B-FGT over the tunnel. If you don't specify the source IP specifically in the RADIUS config, the B-FGT would use the tunnel interface IP for the source IP. So you need to make them reachable each other. Are they?

Toshi

[kcheng]

Hi,

You may want to run a sniffer and see if the RADIUS traffic is generated from the appropriate interface. It may have been generated from other interfaces on the FortiGate. To configure source ip and interface for RADIUS authentication, please refer to the following:

Technical Tip: Source IP for self-originating IPse... - Fortinet Community

[Debbie_FTNT · Accepted solution]

Hey gcarvalho,

you also need to consider that the source IP setting in RADIUS server applies to the entire server entry.
-> if you add the NPS B as secondary RADIUS server, and define a source IP, FortiGate will use this source IP for NPS A as well, so be careful with setting one

-> as Toshi and Kayzie mentioned, you will likely need some kind of source IP setting to allow FortiGate A to send traffic to NPS B via IPSec successfully

-> you might want to consider assigning IPs to the tunnel interfaces themselves instead of setting a source IP in the radius server entry (would need to be done on both sides)

[gcarvalho]

Hello Debbie,

Thanks for the response.

In the case I configure an IP address for the Tunnel Interface, I need to include these IPs in the Firewall Rules to allow comunication in the NPS VLAN?

[gcarvalho]

Hello Toshi, Kayzie and Debbie.

Thanks for the reply.

The source IP for NPS A can be the same to NPS B, so we are trying to set the source IP in the radius entry first.

I have configure in the Fortigate B the source interface for Radius, but it still can't connect. In the Fortigate A I need to set a source-interface too?

Cheers,

Gui

[Toshi_Esumi · Accepted solution]

So you have two NPS RADIUS proxies on both A and B sites and use local one as primary and remote one as secodary? I didn't read that in your original post.

If that's the case, FGT-A needs to reach NPS-B which is the mirror image of FGT-B needing to reach NPS-A. So when FGT-A tries to reach NPS-B, and the route is pointing into the tunnel, FGT-A tries picking up the tunnel IP as its source. Then you want to have an IP there too.

Generally it's a good idea to assign a /30 (or /31) subnet to the tunnel and configure one IP to both sides, like 10.10.1.1/30 on A, 10.10.1.2/30 on B side. Then set phase2 selectors on both sides to allow the IP to get to/get back from the opposite NPS server IP as Debbie said.

These tunnel IPs are useful when you set specific routing toward the tunnel and when you debug with traceroute through the tunnel. Be aware FGT doesn't like the actual interface IP to be configured as /30 for the prefix-length. You need to configure them as 10.10.1.1/32 local, 10.10.1.2/32 remote on one end, and vice versa on the other end. Because they would be put in the routing table as connected routes. If you configure /30s for local and remote, both overlap in the routing table which is not allowed.

Toshi

[gcarvalho]

Thanks again, Toshi!

I will schedule with the customer a window to set the IP address in the tunnel interface. As soon as I do that, I’ll inform the results here!