Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
gcarvalho
New Contributor III

Using a second Radius Server through VPN

Hello

 

We have an environment with two sites: Site A and site B. Both sites have a Fortigate in the edge.

There is a Site-to-Site VPN between this two sites.

 

We'd like to configure in the Fortigate from site B a NPS Server that is in the site A (through VPN). Is that possible? I have tried to do that, but the NPS Server is showed as offline in the Site's B Fortigate and never goes up to online.

 

In the site A, the NPS Server is showed online and is working fine.

 

Is there any configuration that I have to set to the Site's B Fortigate communicate with the NPS Server in the other side of the VPN?

 

The subnet where the NPS is placed is in the "crypto map" of the VPN and there is a policy allowing the communication.

 

Thanks in advanced.

Cheers,
Gui
Cheers,Gui
2 Solutions
Debbie_FTNT
Staff
Staff

Hey gcarvalho,

you also need to consider that the source IP setting in RADIUS server applies to the entire server entry.
-> if you add the NPS B as secondary RADIUS server, and define a source IP, FortiGate will use this source IP for NPS A as well, so be careful with setting one

-> as Toshi and Kayzie mentioned, you will likely need some kind of source IP setting to allow FortiGate A to send traffic to NPS B via IPSec successfully

-> you might want to consider assigning IPs to the tunnel interfaces themselves instead of setting a source IP in the radius server entry (would need to be done on both sides)

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++

View solution in original post

Toshi_Esumi
Esteemed Contributor III

So you have two NPS RADIUS proxies on both A and B sites and use local one as primary and remote one as secodary? I didn't read that in your original post.

If that's the case, FGT-A needs to reach NPS-B which is the mirror image of FGT-B needing to reach NPS-A. So when FGT-A tries to reach NPS-B, and the route is pointing into the tunnel, FGT-A tries picking up the tunnel IP as its source. Then you want to have an IP there too.

 

Generally it's a good idea to assign a /30 (or /31) subnet to the tunnel and configure one IP to both sides, like 10.10.1.1/30 on A, 10.10.1.2/30 on B side. Then set phase2 selectors on both sides to allow the IP to get to/get back from the opposite NPS server IP as Debbie said.


These tunnel IPs are useful when you set specific routing toward the tunnel and when you debug with traceroute through the tunnel. Be aware FGT doesn't like the actual interface IP to be configured as /30 for the prefix-length. You need to configure them as 10.10.1.1/32 local, 10.10.1.2/32 remote on one end, and vice versa on the other end. Because they would be put in the routing table as connected routes. If you configure /30s for local and remote, both overlap in the routing table which is not allowed.

 

Toshi

View solution in original post

7 REPLIES 7
Toshi_Esumi
Esteemed Contributor III

First, you need to make the server IP reachable from the B-FGT over the tunnel. If you don't specify the source IP specifically in the RADIUS config, the B-FGT would use the tunnel interface IP for the source IP. So you need to make them reachable each other. Are they?

 

Toshi

kcheng
Staff
Staff

Hi,

 

You may want to run a sniffer and see if the RADIUS traffic is generated from the appropriate interface. It may have been generated from other interfaces on the FortiGate. To configure source ip and interface for RADIUS authentication, please refer to the following:

Technical Tip: Source IP for self-originating IPse... - Fortinet Community

 

Cheers,
Kayzie Cheng

If you have found a solution, please like and accept it to make it easily accessible for others.
Debbie_FTNT
Staff
Staff

Hey gcarvalho,

you also need to consider that the source IP setting in RADIUS server applies to the entire server entry.
-> if you add the NPS B as secondary RADIUS server, and define a source IP, FortiGate will use this source IP for NPS A as well, so be careful with setting one

-> as Toshi and Kayzie mentioned, you will likely need some kind of source IP setting to allow FortiGate A to send traffic to NPS B via IPSec successfully

-> you might want to consider assigning IPs to the tunnel interfaces themselves instead of setting a source IP in the radius server entry (would need to be done on both sides)

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++
gcarvalho

Hello Debbie,

 

Thanks for the response.

 

In the case I configure an IP address for the Tunnel Interface, I need to include these IPs in the Firewall Rules to allow comunication in the NPS VLAN?

Cheers,
Gui
Cheers,Gui
gcarvalho
New Contributor III

Hello Toshi, Kayzie and Debbie.

 

Thanks for the reply.

 

The source IP for NPS A can be the same to NPS B, so we are trying to set the source IP in the radius entry first.

 

I have configure in the Fortigate B the source interface for Radius, but it still can't connect. In the Fortigate A I need to set a source-interface too?

 

Cheers,

Gui

Cheers,
Gui
Cheers,Gui
Toshi_Esumi
Esteemed Contributor III

So you have two NPS RADIUS proxies on both A and B sites and use local one as primary and remote one as secodary? I didn't read that in your original post.

If that's the case, FGT-A needs to reach NPS-B which is the mirror image of FGT-B needing to reach NPS-A. So when FGT-A tries to reach NPS-B, and the route is pointing into the tunnel, FGT-A tries picking up the tunnel IP as its source. Then you want to have an IP there too.

 

Generally it's a good idea to assign a /30 (or /31) subnet to the tunnel and configure one IP to both sides, like 10.10.1.1/30 on A, 10.10.1.2/30 on B side. Then set phase2 selectors on both sides to allow the IP to get to/get back from the opposite NPS server IP as Debbie said.


These tunnel IPs are useful when you set specific routing toward the tunnel and when you debug with traceroute through the tunnel. Be aware FGT doesn't like the actual interface IP to be configured as /30 for the prefix-length. You need to configure them as 10.10.1.1/32 local, 10.10.1.2/32 remote on one end, and vice versa on the other end. Because they would be put in the routing table as connected routes. If you configure /30s for local and remote, both overlap in the routing table which is not allowed.

 

Toshi

gcarvalho

Thanks again, Toshi!

I will schedule with the customer a window to set the IP address in the tunnel interface. As soon as I do that, I’ll inform the results here!

Cheers,
Gui
Cheers,Gui
Labels
Top Kudoed Authors