topic Fortigate 7.2.6 RADIUS client can't successfully test connection in ExtremeControl

Fortigate 7.2.6 RADIUS client can't successfully test connection

Flavio — Fri, 02 Feb 2024 15:44:31 GMT

Hi all.

Added a Fortigate as RADIUS client but from the Fortigate itself the "test connectivity" is not completing successfully.

With tcpdump on the NAC engine I can see "Access-Request" but no response.

RADIUS client is configured with Authentication Type "Any Access" and would send "RFC 3850 - VLAN ID" attributes. But I don't think this is relevant...

Thanks for any hint!

Re: Fortigate 7.2.6 RADIUS client can't successfully test connection

Zdeněk_Pala — Sun, 04 Feb 2024 13:49:19 GMT

my experience with fortigate (years ago) was that firewall did not provide the port in the radius request. I had to add the fortigate as "switch type = VPN"

good luck

Re: Fortigate 7.2.6 RADIUS client can't successfully test connection

Robert_Haynes — Sun, 04 Feb 2024 15:48:05 GMT

A case was opened by Flavio on this; waiting on traces. This is my suspicion as well that the RADIUS request is missing NAS-Port / Port-Id or some combination therein.

Re: Fortigate 7.2.6 RADIUS client can't successfully test connection

Robert_Haynes — Mon, 05 Feb 2024 17:41:51 GMT

Confirmed via trace. The FortiGate agent is not supplying NAS-Port which for Switch Type "Layer 2 Out-Of-Band" (default) is a required attribute. The request will be summarily dropped without it.

Should be able to use either "Layer 2 RADIUS Only" or "VPN" to side-step this requirement.

RFC 2865
      An Access-Request SHOULD contain a NAS-Port or NAS-Port-Type
      attribute or both unless the type of access being requested does
      not involve a port or the NAS does not distinguish among its
      ports.

EDIT: will also add that the trace indicated the client request was MSCHAPv1. Extreme Control supports PAP, CHAP, MSCHAPv2 and various EAP methods; consider MSCHAPv1 deprecated/obsolete.