unable to authenticate wireless devices via FortiAuthenticator

[oliverlag]

Hello, I' m working on an internal lab where I should test some wireless devices authentication via FortiAuthenticator. I' m running on this issue and this is my topology: WiFiDevice -> FortiAP -> FG -> FA -> W2008 AD I have a simple setup where FG sees FA as a radius server and FA queries W2008 via LDAP. Whenever I connect via mobile phone on FortiAP I can try to login with a username on AD. I can clearly see from logs that FA checks if user is on the domain and if the password is correct. (If I test a unreal username or wrong password I clearly see the authentication fails). Right after this part I always see this log message from FA: https://10.1.2.90/debug/radius/ Loaded remote ldap (regular bind) 10.1.2.110:389 Detected remote LDAP server is a Windows AD server based on configuration No realm detected in username oliver Realm: N/A, Username: oliver ERROR: client is using remote LDAP, but remote LDAP supports PAP only! Updated auth log ' oliver' : Remote LDAP user authentication(mschap) with no token failed: remote server supports pap only It looks like the Windows 2008 server does not support MSCHAPv2 or whatever authentication method is used. I followed several guide where I have enabled NPS policies with PEAP , EAP-MSCHAPv2, CHAP but despite that I always receivce this message. Is there something I can do on Fortinet part? Someone maybe can help on MS part too? Thanks in advance.

[Matthew_Mollenhauer]

In pure ldap mode the FAC will only do Password Authentication Protocol, it won' t do MSCHAPv2. What you need to do is join the FAC to your domain so that it is able to get a Kerberos ticket to use in authentications. When you define your remote LDAP servers you need to tick the box for " Windows Active Directory Domain Authentication" and enter the relevant items for your domain. Authentication -> Remote Auth Servers -> LDAP Regards, Matthew