admins auth via radius (MS IAS)

[#1]

Hi All, Did anyone managed to configure admin authorization from Radius server (MS IAS). I' ve got to a stage where Windows is showing that user has been authorized but FGT still doesn' t let me in. VSA in IAS is set like this: Vendor-Code: 12356 Vendor assigned attribute number: 1 Attribute format: String Value: prof_admin Debug in the CLI (diag deb appl fnbamd 255) is showing following: fnbamd_fsm.c[886] handle_req-Rcvd auth req 2883595 for adm in ADMINS_IAS opt=1 prot=8 fnbamd_radius.c[780] fnbamd_radius_auth_send-Sent radius req to 10.0.0.1: code=1 id=34 len=155 user=" adm" using MS-CHAPv2 fnbamd_auth.c[544] auth_tac_plus_start-Didn' t find tac_plus servers (0) fnbamd_auth.c[292] ldap_start-Didn' t find ldap servers (0) fnbamd_radius.c[980] fnbamd_radius_auth_validate_pkt-Invalid digest fnbamd_auth.c[1240] fnbamd_auth_handle_result-Error validating radius rsp fnbamd_fsm.c[1068] handle_auth_rsp-Error (5) for req 2883595 fnbamd_fsm.c[1134] handle_auth_timeout_with_retry-Session timeout, retry fnbamd_auth.c[205] radius_start-Didn' t find radius servers (0) fnbamd_fsm.c[1145] handle_auth_timeout_with_retry-retry failed fnbamd_fsm.c[1177] handle_auth_timeout_without_retry-Session expired fnbamd_comm.c[104] fnbamd_comm_send_result-Sending result 3 for req 2883595 IAS is showing that user has been granted access. My assumption is that either FGT doesn' t like self-signed cert for MS-CHAPv2 on the radius or the parameters inside IAS are wrong. Please help. Marko

[abelio]

Did you test manually radius authentication from the FGT against your server? Another point: default auth type is ' auto' and ' PAP' is the first type attempted; ' auto' uses PAP, MSCHAP_v2, and CHAP in that order Could you post the output of CLI command: " show full user radius" ?

[#3]

manual radius test: GATEKEEPER # diagnose test authserver radius slemish_ias mschap2 adm Password authenticate ' adm' against ' mschap2' failed(no response), assigned_rad_session_id=46989312 session_timeout=0 secs! Auth is set to MSCHAP2 otherwise IAS doesn' t authorize the user (I' ve tried PAP, CHAP, MSCHAP, MSCHAP2) GATEKEEPER # show full user radius config user radius edit " slemish_ias" set all-usergroup disable set auth-type ms_chap_v2 set nas-ip 0.0.0.0 set radius-port 0 set secret ENC wDxrew/rh0jJUGMLyR76XasKJMRUS6IcT/9UMo9Yc4+j4a9W0Vb7/TRqUMS9jMW3iV/EKMBESMfUUtsfSIaWWpfsAI4CT15vO3Aoacz5LNt/E8ID set server " 10.0.0.1" set use-group-for-profile disable set use-management-vdom disable set secondary-secret ENC O422NLZh5WBJn7c9Xk7M87YEwTERLzIt0T9bWSkswluTN/h1VLmgzGh791fTEvq2Xv1X974r+Pz52ffC9g5xGG+KMUl6+luzZIcl+1NnfRQwvYo9 set secondary-server ' ' next end Output from Event Viewer: User adm was granted access. Fully-Qualified-User-Name = DOMAIN\adm NAS-IP-Address = <not present> NAS-Identifier = GATEKEEPER Client-Friendly-Name = FortiGate300A Client-IP-Address = 10.0.0.2 Calling-Station-Identifier = <not present> NAS-Port-Type = <not present> NAS-Port = <not present> Proxy-Policy-Name = Use Windows authentication for all users Authentication-Provider = Windows Authentication-Server = <undetermined> Policy-Name = fortigate_access Authentication-Type = MS-CHAPv2 EAP-Type = <undetermined> Any ideas? -- Marko

[abelio]

ORIGINAL: marko manual radius test: GATEKEEPER # diagnose test authserver radius slemish_ias mschap2 adm Password authenticate ' adm' against ' mschap2' failed(no response), assigned_rad_session_id=46989312 session_timeout=0 secs! Auth is set to MSCHAP2 otherwise IAS doesn' t authorize the user (I' ve tried PAP, CHAP, MSCHAP, MSCHAP2)

Ok, stop here a moment; for some reason there' s no communication (no response error message) between the Fortigate and the radius server; First the basics things: - which AA ports is talking your radius server? 1645/1646 or 1812/1813 ? If you want to know which port uses your FTGate radius client, look for " radius-port" line within the output of " show system global" CLI command. - re-check secrets in both sides once again and re-try hope it helps,

[#5]

the ports are set to 1812. I' ve resetted passwords. it still does the same and that' s what makes me wonder...because the test (same as the login attempt) is recorded on the IAS as a successful authorization. maybe I' m missing some specific parameters that IAS should return to the FGT... any ideas? -- Marko

[abelio]

ok, Does your ' adm' user belong to user_group where ' slemish_ias" is already included? I mean: the output of your " show system admin adm" CLI command includes the lines: " set remote-auth enable" and " set remote-group " X_group" where ' slemish_ias' radius server is included as a member?

[#7]

yes, GATEKEEPER # show system admin adm config system admin edit " adm" set remote-auth enable set accprofile " prof_admin" set vdom " root" set wildcard enable set remote-group " ADMINS_IAS" next end and GATEKEEPER # show user group ADMINS_IAS config user group edit " ADMINS_IAS" set profile " unfiltered" set member " slemish_ias" next end I' ve also made an expermient - captured and decoded the coversation between FGT and IAS: QUERY - Layer 3 decode: Frame 1: 10.0.0.2 - fortigate --> 10.0.0.1 - slemish Size=197 Bytes Send_Time=0.000000 secs Recv_Time=0.000002 secs UDP: User Datagram Protocol, Src Port: solid-mux (1029), Dst Port: radius (1812) Source port: solid-mux (1029) Destination port: radius (1812) Length: 163 Checksum: 0x3856 [Good Checksum: False] [Bad Checksum: False] QUERY - Layer 4 decode: RADIUS: Access-Request(1) (id=54, l=155) Code: Access-Request (1) Packet identifier: 0x36 (54) Length: 155 Authenticator: 6183D93712BCF63496449957EDBDB72B Attribute Value Pairs AVP: l=12 t=NAS-Identifier(32): GATEKEEPER NAS-Identifier: GATEKEEPER AVP: l=12 t=User-Name(1): adm User-Name: adm AVP: l=76 t=Vendor-Specific(26) v=Microsoft(311) VSA: l=52 t=MS-CHAP2-Response(25): RESPONSE - Layer 3 decode: Frame 2: 10.0.0.1 - slemish --> 10.0.0.2 - fortigate Size=263 Bytes Send_Time=2.244490 secs Recv_Time=2.244492 secs UDP: User Datagram Protocol, Src Port: radius (1812), Dst Port: solid-mux (1029) Source port: radius (1812) Destination port: solid-mux (1029) Length: 229 Checksum: 0x9531 [Good Checksum: False] [Bad Checksum: False] RESPONSE - Layer 4 decode: RADIUS: Access-Accept(2) (id=54, l=221) Code: Access-Accept (2) Packet identifier: 0x36 (54) Length: 221 Authenticator: 6C45B92192717289DEC7E305B283FD87 [This is a response to a request in frame 1] [Time from request: 2.244490000 seconds] Attribute Value Pairs AVP: l=18 t=Vendor-Specific(26) v=Fortinet, Inc.(12356) VSA: l=12 t=Unknown-Attribute(1): 70726F665F61646D696E Unknown-Attribute: 70726F665F61646D696E AVP: l=32 t=Class(25): the communication looks OK. more I look into this more I think that' s IAS sending wrong respose ... I' ve raised a support ticked with Fortinet. Will see what will they say. -- Marko

[#8]

Just found this: ftp://support.fortinet.com/FortiGate/v3.00/MR7/RADIUS/dictionary.fortinet.fos.v300.mr7.txt so I' ve changed:

Vendor assigned attribute number: 1

to:

Vendor assigned attribute number: 6

still didn' t help...

[abelio]

humm, just a shot in the dark: accepted for your radius but unable to login as adm into your FTG: what about ' trusted hosts' for " adm" user?

[#10]

I' ve checked that ... it' s set to accept from all....