Radius Authentication

[rudolf76]

Hello,

I know that this topic was already discussed in the forum, but the solution did not solved my issue. I have a problem with the RADIUS authentication from a FG100F to a NPS Windows Server. When I try to authenticate I get this error:

"AVP: l=22 t=Vendor-Specific(26) v=Microsoft(311) VSA: l=16 t=MS-CHAP-Error(2) Value: '<00>E=691 R=0 V=3'"

But I don't know if this error comes from the FG or from the NPS server.

The thing is, I have already a FG which is connected to the same RADIUS server and with this firewall it works. But when I connect another FG to the same RADIUS, it doesn't. 

So I guess the new firewall must be allowed somewhere in the NPS to make authentication requests.

Had someone other this problem as well, and maybe a solution?

Thank you!!!!!!

br

Rudolf

[ebilcari]

In the RADIUS server you have to add the RADIUS clients (NAS), in this case the IP of the FGT. Pay attention to the source IP that FGT uses for these requests, if it's a different source IP (or NATed) the requests will be dropped. You can also specify the source IP when you configure the RADIUS server in FGT as  the NAS IP.

[adimailig]

Please refer to below guide on how to deploy Microsoft NPS (RADIUS). Please check if steps 1 - 5 is configured properly.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-FortiGate-and-Microsoft-NPS-Ra...

You may also refer to below guide on how to troubleshoot, RADIUS authentication from Fortigate
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Radius-authentication-troubleshooting/ta-p...

[rudolf76]

Hi all, I'm a little bit closer to the solution. :)

It is possible to authenticate now against the Radius server. I get also a phone call from Microsoft because of MFA. This works so far. But after or during the authentication process I get this error when I try to authenticate via CLI on the FG:

authenticate 'user@domain.com' against 'mschap2' failed(no response), assigned_rad_session_id=1373936999 session_timeout=0 secs idle_timeout=0 secs!

And in the Fortigate GUI there is the message in the Radius config: Can't contact Radius server. After the auth. process has been finished, FG is able to connect the Radius server again.

So authentication works, but it immediately closes the connection.