I need help from you guys since I can't find anything wrong with my setup and it still doesn't work:

I authenticate my Fortigate SSLVPN users against FortiAuthenticator. I want to map some users to a Firewall group in my FG using Radius attributes. I used the "Fortinet-Group-Name" and "fortinet-Access-profile" attributes (set to "test")

this is my Fortigate config : (FAC-Group for users without attributes, grp-test for users with attribute set to "test")

config user group
    edit "SSO_Guest_Users"
    edit "FAC-Group"
        set member "FortiAuthenticator"
    edit "grp-test"
        set member "FortiAuthenticator"
        config match
            edit 1
                set server-name "FortiAuthenticator"
                set group-name "test"

this is my debug output :

[1309] __fnbamd_rad_send-Sent radius req to server 'FortiAuthenticator': fd=16, IP=--------------(------------:1812) code=1 id=100 len=101
 user="domain\user" using PAP
[1179] send_radius_challenge_rsp-Timer of rad 'FortiAuthenticator' is added
[1348] fnbamd_auth_handle_radius_result-Timer of rad 'FortiAuthenticator' is deleted
[1767] fnbamd_radius_auth_validate_pkt-RADIUS resp code 2
[319] extract_success_vsas-FORTINET attr, type 1, val test
[353] extract_success_vsas-FORTINET attr, type 6, val test
[1374] fnbamd_auth_handle_radius_result-->Result for radius svr 'FortiAuthenticator' ---------- is 0
[1304] fnbamd_radius_group_match-Skipping group matching
[1018] find_matched_usr_grps-Skipped group matching
[217] fnbamd_comm_send_result-Sending result 0 (nid 0) for req 1251334245, len=2014
[747] destroy_auth_session-delete session 1251334245
authenticate 'domain\user' against 'pap' succeeded, server=primary assigned_rad_session_id=1251334245 assigned_admin_profile=test s
ession_timeout=0 secs idle_timeout=0 secs!
Group membership(s) - test

As you can see, the FortiGate matches and extracts the Group Name but still skips the user mapping to the new Group. I tried deleting the "FAC-Group" but then I was unable to even connect.

FG : 6.4.2 FAC : 6.1.2

Any help is appreciated!


I just ran into this. Here's a link to the page that explained it to me. (Scroll down to "Gotcha 1: Set the Group".)

Relevant excerpt:

If you set the group to anything other than Any, things won’t work. This may seem a bit odd, as for example you might wish to limit VPN access to an AD group called ‘VPN Users’. It would make sense right? But this group would actually be a check against a Vendor specific AV pair that the radius server may return and not related to AD at all. See this link: https://kb.fortinet.com/kb/documentLink.do?externalID=FD40923

[...] Result 0 means the authentication worked, but you then see that the group matching is skipped. This is because the NPS server did not return the AV Pair Fortinet-Group-Name which is what gets used for matching. More details here: https://kb.fortinet.com/kb/documentLink.do?externalID=FD36464

So basically you need to control the access some other way. Either by Individually allowing Dial-In access. (AD User Manager –> Find User -> Properties -> Dial-In) or by Creating an NPS Policy to allow access to your AD group

I did find a Fortinet article describing how to set up Windows NPS as a RADIUS server with this group. I'm not going to paste the whole article here, but here is a link to an archive.org-saved version.

Hope that helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.