Description
This article describes how to test a FortiGate user authentication to the RADIUS server.
Scope
FortiGate.
Solution
The CLI of the FortiGate includes an authentication test command:
diagnose test authserver radius
<server_name> <chap | pap | mschap | mschap2> <username> <password>
Run this test command as soon as the RADIUS server configuration is complete.
It does not require the FortiGate configuration to contain a user group or firewall policy.
If there are no issues with the RADIUS server configuration or user credentials, the RADIUS server returns an authentication confirmation and a list of the user groups for that user.
For example (command outputs from FortiOS v7.2):
diagnose debug application fnbamd -1
Debug messages will be on for 30 minutes.
diagnose debug enable
diagnose test authserver radius radserver1 pap raduser1 password123
[1909] handle_req-Rcvd auth req 1190820099 for raduser1 in radserver1 opt=0100001d prot=0
[489] __compose_group_list_from_req-Group 'radserver1', type 1
[616] fnbamd_pop3_start-raduser1
[531] __fnbamd_cfg_get_radius_list_by_server-Loading RADIUS server 'radserver1'
[342] fnbamd_create_radius_socket-Opened radius socket 10
[342] fnbamd_create_radius_socket-Opened radius socket 11
[1476] fnbamd_radius_auth_send-Compose RADIUS request
[1433] fnbamd_rad_dns_cb-10.5.56.169->10.5.56.169
[1405] __fnbamd_rad_send-Sent radius req to server 'radserver1': fd=10, IP=10.5.56.169(10.5.56.169:1812) code=1 id=1 len=97 user="raduser1" using PAP <- Username and scheme.
[319] radius_server_auth-Timer of rad 'radserver1' is added
[652] create_auth_session-Total 1 server(s) to try
[1950] handle_req-r=4
[1522] fnbamd_auth_handle_radius_result-Timer of rad 'radserver1' is deleted
[1890] fnbamd_radius_auth_validate_pkt-RADIUS resp code 2 <- 2=Access-Accept, 3=Access-Reject, 11=Access-Challenge.
[323] extract_success_vsas-FORTINET attr, type 1, val radgroup1 <- RADIUS attributes.
[1548] fnbamd_auth_handle_radius_result-->Result for radius svr 'radserver1' 10.5.56.169(1) is 0 <- 0=Authentication successful, 1=Authentication failed.
[281] find_matched_usr_grps-Skipped group matching
[209] fnbamd_comm_send_result-Sending result 0 (nid 0) for req 1190820099, len=2551
authenticate 'raduser1' against 'pap' succeeded, server=primary assigned_rad_session_id=1190820099 session_timeout=0 secs idle_timeout=0 secs!
Group membership(s) - radgroup1
In case there are no debugs, verify the connectivity by using the below command:
Try pinging the RADIUS server:
execute ping a.b.c.d -> a.b.c.d is the server ip
The packet sniffer can be performed to verify, that traffic is going out on the correct interface:
diag sniffer packet any ' host a.b.c.d ' 4 0 l
Related articles:
