Troubleshooting

Troubleshooting includes useful tips and commands to help deal with issues that may occur. For additional help, contact customer support. See Troubleshooting for more information.

If you have issues when attempting authentication on a FortiGate unit using the FortiAuthenticator, there are some FortiAuthenticator and FortiGate settings to check.

In addition to these settings you can use log entries, monitors, and debugging information to determine more knowledge about your authentication problems. For help with FortiAuthenticator logging, see Logging. For help with FortiGate troubleshooting, see the FortiOS Handbook for troubleshooting user authentication.

FortiAuthenticator settings

When checking FortiAuthenticator settings, you should ensure that:

• There is an authentication client entry for the FortiGate unit (see RADIUS service).
• The user trying to authenticate has a valid active account that is not disabled, and that the username and password are entered correctly.
• The user account allows RADIUS authentication if RADIUS is enabled on the FortiGate unit.
• The FortiGate unit can communicate with FortiAuthenticator, on the required ports:
• RADIUS Authentication: UDP/1812
• LDAP: TCP/389
• The user account exists either:
• as a local user on the FortiAuthenticator (if using RADIUS authentication),
• in the local LDAP directory (if using local LDAP authentication),
• and/or in the remote LDAP directory (if using RADIUS authentication with remote LDAP password validation).
• The user is a member in the expected user groups and these user groups are allowed to communicate on the authentication client (e.g. the FortiGate).
• If authentication fails with the log error "bad password", try resetting the password. If this fails, verify that the pre-shared secret is identical on both FortiAuthenticator and the authentication client.

If FortiToken authentication is failing, try the following:

• Verify that the token is correctly synchronized.
• Remove the token from the user authentication configuration and verify authentication works when the token is not present.
• Attempt to log into the FortiAuthenticator with the user credentials.

These steps enable the administrator to identify whether the problem is with the FortiGate unit, the credentials, or the FortiToken.

FortiGate settings

When checking FortiGate authentication settings, you should ensure that:

• The user has membership in the required user groups and identity-based security policies.
• There is a valid entry for the FortiAuthenticator device as a remote RADIUS or LDAP server.
• The user is configured either explicitly or as a wildcard user.