Wireless authentication fail - Fortiauthenticator + OpenLDAP

[mcosta2587]

Hi Evryone, 

I've seted up an environement for users authentication pourpose (SSL-VPN and Wireless).

I've a FortiGate + FortiAuthenticator (as Radius server) + OpenLDAP (as LDAP authentication server).

The RADIUS connection between Fortigate and FAC its ok.

The LDAP connection with FAC and OpenLDAP is established, and I can import users, create Sync rules, etc. 

SSL-VPN RA users are able to authenticate with no issues, but the same user are not able to authenticate via wireless (authentication fails, password incorrect). But I test passing the password in clear text (PAP), works well. 

Wireless authentication method is EAP-PEAP-mschapv2. 

I've teste from fortigate GUI in RADIUS server -> "test user credentials", and fails with chap and mschapv2, only work with PAP.

There are some atributes that I should define on Fortiauthenticator(FAC) side?

FAC have a disctionary for with vendors atributes, but I'm not sure if I need to define it.

Does anyone faced or facing this issue?
Thanks in advance for your support!

[Tahsin]

Hi Mcosta2587,

Is it possible, could you share LDAP configuration and radius policy on Fortiauthenticator?

I think, you should use LDAPS and domain authentication on Fortiauthenticator.

BR.

[quenis6]

Have set this up. There are few way to do it. NAS IP is one way to differentiate between WiFi users and vpn users. The method I used was to configure two radius server profiles on the fortigate and then set the source-ip differently so the requests came from different IPs https://mobdro.bio/ .

[Debbie_FTNT]

Hey mcosta,

there are two things you need to take into account:

1. RADIUS policies for Wifi vs SSLVPN

- FortiAuthenticator has RADIUS policies, and selects a matching one based on RADIUS client (your FortiGate) IP

- if you have two policies (one for SSLVPN authentication, one for Wifi) it is likely only the top policy is matched

-> as quenis6 mentioned, FortiAuthenticator needs some way to distinguish between authentication requests for Wifi and for VPN

-> having two RADIUS server profiles on FortiGate, to set separate source IPs, and thus match into different RADIUS clients on FortiAuthenticator, is an option

-> another method I like to use is to have two RADIUS policies in FortiAuthenticator, the top one for SSLVPN and with a required RADIUS attribute: Connect-Info=SSL (with 'allow substring match' toggled on), and the second RADIUS policy below it with no filter (and having EAP methods enabled)

--> all SSLVPN authentication attempts will hit the first policy; anything NOT SSLVPN will fall through to the second policy

2. PAP vs CHAP vs MS-CHAPv2

- In your setup (involving OpenLDAP), FortiAuthenticator will only be able to authenticate users if it gets the user password in cleartext

- this is due to OpenLDAP involvement:

-> FortiAuthenticator has to check the user credentials against OpenLDAP

-> CHAP/MS-CHAPv2 send a password hash, not cleartext password

-> FortiAuthenticator could forward that password hash, but LDAP servers are not able to understand that, they expect cleartext password

- if you use a Windows (AD) LDAP server, and FortiAuthenticator is joined to the domain, you can also do MS-CHAPv2, as FortiAuthenticator can use NTLM to authenticate the user, and MS-CHAPv2 works in that context, but CHAP will not work then, either

So, what you probably need to do:

- do not use MS-CHAP-v2 for your wifi users

- check the RADIUS policies on FortiAuthenticator to ensure Wifi users are hitting the correct policy, not the one for SSLVPN users (assuming you DO have a separate policy for sslvpn and wifi)

I hope this helps!

Cheers,

Debbie

[mcosta2587]

Hi @Debbie_FTNT and @quenis6 

Based on you suggestion, I've created two differente contexts - one for SSL authentication, and another one for Wireless. I created two radious profiles, with diferent NAS IP, and two different RADIUS policies on FAC. 
I've now a differente visibility and logging, thanks for the tip. 

Based on you explanation and based on some artiecles that I read, It's "impossible" to authenticate wireless users based on EAP-PEAP sessions agains OpenLdap, except, if the users using clear text authetication methods (PAP). 

But, the question is, the client production setup, have a FreeRadius server, and wireless users are able to authenticate (suplicant >> fortigate >> freeradius >> openldap), using the default windows authentication method (EAP-PEAP mschapv2). 
The setup that I want to implent, It's just remove Freeraius from that equation, and put FAC!

Do you have any suggestion?

Thanks for your support!

[mcosta2587]

Hi Debbie and all the others. 

Thanks for your feedback. 
I wiil analyze your recomendations, and replicate them on my environment. 
Onve I have some outcome, I will let you know. 

Thanks a lot for your support!