fortigate firewall suddenly not working with cisco ise as Radius server

[Zayd]

Hello,

I am facing an issue with fortigate firewall in cluster a-p, both are integrated with cisco ise working as Radius server.

Suddenly, we are seeing that Radius settings for ISE is failed; saying " can't contact radius server"

Fortigate version is 7.2.4

however, there is another set of FGT firewalls which are working fine.

Only difference is that these firewalls are in DMZ and ISE is behind mgmt firewalls which are working fine. So DMZ Fws talk via transit vlan.

[AEK]

Hi Zayd

Does the second firewall have the same FOS (7.2.4)?

Can you confirm if the RADIUS request reaches ISE?

[Zayd]

I dont see request reaching the ise.

yes both fgt has 7.4.2

[AEK]

You need to make sure RADIUS request from FG properly reach ISE.

E.g. if there is a firewall between them you need to allow the related traffic.

[Zayd]

Thanks for the reply...

FGT debugs shows ISE connection STOP duo time-out. ISE diagnostic tcpdump does not receive any packets.

About ISE receive request from correct ip as mentioned in NAD settings: So the answer is>>

>>Since the FGT is sitting in DMZ nw having mgmt ip(10.10.200.10) and transit ip 10.1.1.10 towards the ISE which is in management zone, when i test connection from FGT radius settings for ISE, i see ip 10.1.1.10 as the outgoing ip address from FGT as well as on the management zone FGT as incoming ip 10.1.1.10 towards ISE ip 10.10.50.50.

After this we have NSX fw before it reaches ISE vm.

SO my understanding of the traffic flow is as follows let me know if am right:

> Admin access DMZ FGT via bowser > Put his AD credentials > Enter 

> DMZ FGT request will go towards management FGT with outgoing transit ip 10.1.1.10

> Management FGT receives 10.1.1.10 as incoming interface ip towards dest, ISE 10.10.50.50 as outgoing interface

> NSX Fw will receive incoming request from ip 10.1.1.10 towards ISE ip 

> Finally ISE will receive traffic, however here the glitch is NAD ip here is 10.10.200.10

>  Which i believe is wrong becoz NAD ip configured i different.

So where am going wrong, on the DMZ FGT, where the request should come out from it mgmt ip itself ? becoz the route on it for ISE is from transit ip only 10.1.1.10

[funkylicious]

the source ip/interface ip is selected based on route lookup towards ISE.

you can set it to a specific ip/interface with set source-ip , under radius config on FGT or even select the specific interface manually.

https://docs.fortinet.com/document/fortigate/7.2.4/cli-reference/519620/config-user-radius 

[Zayd]

@funkylicious Thanks for sharing the article.

I tried adding the source ip add as mgmt interface ip, however it rejects and say interface not in root vdom.

i dont know y, since the mgmt interface is directly connectrd to oob sw, so how traffic will traverse through the fw data plane to take effect the ise radius config. 

[funkylicious]

i assume that you are using multi-vdom ?

if so, try disabling under config user radius :

set use-management-vdom [enable|disable]

[Zayd]

@funkylicious i have only one vdom which is root by-default, i found one conversation which is matching my use-case. below i marked.

https://community.fortinet.com/t5/Support-Forum/Use-MGMT-interface-as-source-ip-for-radius/m-p/21288...

since i also a dedicated mgmt interface plus ha settings have ha mgmt interface enabled and gateway configured the mgmt gw ip.

The article says to config ha-direct, i am thinkin will it resolve the issue.

[Zayd · Accepted solution]

@funkylicious , today the issue was resolved after enabling the ha-direct settings in HA settings.