Clients

You must configure each device requesting authorization from the RADIUS server as a FortiAuthenticator RADIUS client.

RADIUS accounting clients can be managed from Authentication > RADIUS Service > Clients.

Configured clients are assigned to one or more RADIUS policies that determine the authentication logic.

To configure a RADIUS client:

1. Go to Authentication > RADIUS Service > Clients, and click Create New to add a new RADIUS client.
   The Create New Authentication Client window opens.
2. Provide the following information to configure the client:

   Subnets and IP ranges can be defined in the Client address field. All authentication clients within a defined subnet/IP range will share the same configuration and shared secret. For example, 192.168.0.0/24 would allow all 255 IP addresses to authenticate. This saves time because it only uses a single client entry in the license table.

   Name	A name to identify the authentication client.
   Client address	The IP/Hostname, Subnet, or Range of the client.
   Secret	The RADIUS passphrase shared with the client.
   Accept RADIUS account messages for usage enforcement	Allows FortiAuthenticator to accept RADIUS accounting messages for usage enforcement. In order to accept account messages for enforcement, the client address must be set as an IP/Hostname. Subnet and Range client address types are not supported.
   Support RADIUS Disconnect messages	Allows FortiAuthenticator to support RADIUS Disconnect messages. In order to support RADIUS disconnect messages, the client address must be set as an IP/Hostname. Subnet and Range client address types are not supported.

3. Select OK to add the new RADIUS client.
   

   If authentication fails, check that the authentication client is configured and that its IP address is correctly specified. Common causes of problems are: RADIUS packets sent from an unexpected interface, or IP address. NAT performed between the authentication client and FortiAuthenticator.