Hi Evryone,
I've seted up an environement for users authentication pourpose (SSL-VPN and Wireless).
I've a FortiGate + FortiAuthenticator (as Radius server) + OpenLDAP (as LDAP authentication server).
The RADIUS connection between Fortigate and FAC its ok.
The LDAP connection with FAC and OpenLDAP is established, and I can import users, create Sync rules, etc.
SSL-VPN RA users are able to authenticate with no issues, but the same user are not able to authenticate via wireless (authentication fails, password incorrect). But I test passing the password in clear text (PAP), works well.
Wireless authentication method is EAP-PEAP-mschapv2.
I've teste from fortigate GUI in RADIUS server -> "test user credentials", and fails with chap and mschapv2, only work with PAP.
There are some atributes that I should define on Fortiauthenticator(FAC) side?
FAC have a disctionary for with vendors atributes, but I'm not sure if I need to define it.
Does anyone faced or facing this issue?
Thanks in advance for your support!
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi Mcosta2587,
Is it possible, could you share LDAP configuration and radius policy on Fortiauthenticator?
I think, you should use LDAPS and domain authentication on Fortiauthenticator.
BR.
Have set this up. There are few way to do it. NAS IP is one way to differentiate between WiFi users and vpn users. The method I used was to configure two radius server profiles on the fortigate and then set the source-ip differently so the requests came from different IPs https://mobdro.bio/ .
Hey mcosta,
there are two things you need to take into account:
1. RADIUS policies for Wifi vs SSLVPN
- FortiAuthenticator has RADIUS policies, and selects a matching one based on RADIUS client (your FortiGate) IP
- if you have two policies (one for SSLVPN authentication, one for Wifi) it is likely only the top policy is matched
-> as quenis6 mentioned, FortiAuthenticator needs some way to distinguish between authentication requests for Wifi and for VPN
-> having two RADIUS server profiles on FortiGate, to set separate source IPs, and thus match into different RADIUS clients on FortiAuthenticator, is an option
-> another method I like to use is to have two RADIUS policies in FortiAuthenticator, the top one for SSLVPN and with a required RADIUS attribute: Connect-Info=SSL (with 'allow substring match' toggled on), and the second RADIUS policy below it with no filter (and having EAP methods enabled)
--> all SSLVPN authentication attempts will hit the first policy; anything NOT SSLVPN will fall through to the second policy
2. PAP vs CHAP vs MS-CHAPv2
- In your setup (involving OpenLDAP), FortiAuthenticator will only be able to authenticate users if it gets the user password in cleartext
- this is due to OpenLDAP involvement:
-> FortiAuthenticator has to check the user credentials against OpenLDAP
-> CHAP/MS-CHAPv2 send a password hash, not cleartext password
-> FortiAuthenticator could forward that password hash, but LDAP servers are not able to understand that, they expect cleartext password
- if you use a Windows (AD) LDAP server, and FortiAuthenticator is joined to the domain, you can also do MS-CHAPv2, as FortiAuthenticator can use NTLM to authenticate the user, and MS-CHAPv2 works in that context, but CHAP will not work then, either
So, what you probably need to do:
- do not use MS-CHAP-v2 for your wifi users
- check the RADIUS policies on FortiAuthenticator to ensure Wifi users are hitting the correct policy, not the one for SSLVPN users (assuming you DO have a separate policy for sslvpn and wifi)
I hope this helps!
Cheers,
Debbie
Hi @Debbie_FTNT and @quenis6
Based on you suggestion, I've created two differente contexts - one for SSL authentication, and another one for Wireless. I created two radious profiles, with diferent NAS IP, and two different RADIUS policies on FAC.
I've now a differente visibility and logging, thanks for the tip.
Based on you explanation and based on some artiecles that I read, It's "impossible" to authenticate wireless users based on EAP-PEAP sessions agains OpenLdap, except, if the users using clear text authetication methods (PAP).
But, the question is, the client production setup, have a FreeRadius server, and wireless users are able to authenticate (suplicant >> fortigate >> freeradius >> openldap), using the default windows authentication method (EAP-PEAP mschapv2).
The setup that I want to implent, It's just remove Freeraius from that equation, and put FAC!
Do you have any suggestion?
Thanks for your support!
Hi Debbie and all the others.
Thanks for your feedback.
I wiil analyze your recomendations, and replicate them on my environment.
Onve I have some outcome, I will let you know.
Thanks a lot for your support!
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1710 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.