Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Administration Guide

Clients

You must configure each device requesting authorization from the RADIUS server as a FortiAuthenticator RADIUS client.

RADIUS accounting clients can be managed from Authentication > RADIUS Service > Clients.

Configured clients are assigned to one or more RADIUS policies that determine the authentication logic.

To configure a RADIUS client:
  1. Go to Authentication > RADIUS Service > Clients, and click Create New to add a new RADIUS client.
    The Create New Authentication Client window opens.
  2. Provide the following information to configure the client:
    note icon

    Subnets and IP ranges can be defined in the Client address field. All authentication clients within a defined subnet/IP range will share the same configuration and shared secret. For example, 192.168.0.0/24 would allow all 255 IP addresses to authenticate. This saves time because it only uses a single client entry in the license table.

    NameA name to identify the authentication client.
    Client addressThe IP/Hostname, Subnet, or Range of the client.
    SecretThe RADIUS passphrase shared with the client.

    Accept RADIUS account messages for usage enforcement

    Allows FortiAuthenticator to accept RADIUS accounting messages for usage enforcement.

    Note

    In order to accept account messages for enforcement, the client address must be set as an IP/Hostname. Subnet and Range client address types are not supported.

    Support RADIUS Disconnect messages

    Allows FortiAuthenticator to support RADIUS Disconnect messages.

    Note

    In order to support RADIUS disconnect messages, the client address must be set as an IP/Hostname. Subnet and Range client address types are not supported.

  3. Select OK to add the new RADIUS client.

    If authentication fails, check that the authentication client is configured and that its IP address is correctly specified. Common causes of problems are:

    • RADIUS packets sent from an unexpected interface, or IP address.
    • NAT performed between the authentication client and FortiAuthenticator.
To import RADIUS clients:
  1. Go to Authentication > RADIUS Service > Clients, and click Import.

    The Import RADIUS Clients window opens.

  2. Click Upload a file and choose the file location of the CSV file containing your RADIUS client list.

    Each line of the CSV file must contain values in the following format:

    • Name: String (the same character restrictions as in the GUI).

    • Address: IP address, subnet, or IP range.

    • Secret: String (the same character restrictions as in the GUI).

    • Accept RADIUS accounting messages for usage enforcement: Boolean ('t' or 'f').

    • Support RADIUS Disconnect messages: Boolean ('t' or 'f').

    • Policy: Name of a RADIUS policy (optional).

      For example:

    • Unique IP and policy: myclient,1.2.3.4,secret123,f,f,mypolicy

    • Subnet and no policy: myclients,1.2.4.0/24,secret123,t,t,

    • IP range and policy: myotherclients,1.2.5.10-1.2.5.19,secret123,t,f,mypolicy

  3. Click OK.

Clients

You must configure each device requesting authorization from the RADIUS server as a FortiAuthenticator RADIUS client.

RADIUS accounting clients can be managed from Authentication > RADIUS Service > Clients.

Configured clients are assigned to one or more RADIUS policies that determine the authentication logic.

To configure a RADIUS client:
  1. Go to Authentication > RADIUS Service > Clients, and click Create New to add a new RADIUS client.
    The Create New Authentication Client window opens.
  2. Provide the following information to configure the client:
    note icon

    Subnets and IP ranges can be defined in the Client address field. All authentication clients within a defined subnet/IP range will share the same configuration and shared secret. For example, 192.168.0.0/24 would allow all 255 IP addresses to authenticate. This saves time because it only uses a single client entry in the license table.

    NameA name to identify the authentication client.
    Client addressThe IP/Hostname, Subnet, or Range of the client.
    SecretThe RADIUS passphrase shared with the client.

    Accept RADIUS account messages for usage enforcement

    Allows FortiAuthenticator to accept RADIUS accounting messages for usage enforcement.

    Note

    In order to accept account messages for enforcement, the client address must be set as an IP/Hostname. Subnet and Range client address types are not supported.

    Support RADIUS Disconnect messages

    Allows FortiAuthenticator to support RADIUS Disconnect messages.

    Note

    In order to support RADIUS disconnect messages, the client address must be set as an IP/Hostname. Subnet and Range client address types are not supported.

  3. Select OK to add the new RADIUS client.

    If authentication fails, check that the authentication client is configured and that its IP address is correctly specified. Common causes of problems are:

    • RADIUS packets sent from an unexpected interface, or IP address.
    • NAT performed between the authentication client and FortiAuthenticator.
To import RADIUS clients:
  1. Go to Authentication > RADIUS Service > Clients, and click Import.

    The Import RADIUS Clients window opens.

  2. Click Upload a file and choose the file location of the CSV file containing your RADIUS client list.

    Each line of the CSV file must contain values in the following format:

    • Name: String (the same character restrictions as in the GUI).

    • Address: IP address, subnet, or IP range.

    • Secret: String (the same character restrictions as in the GUI).

    • Accept RADIUS accounting messages for usage enforcement: Boolean ('t' or 'f').

    • Support RADIUS Disconnect messages: Boolean ('t' or 'f').

    • Policy: Name of a RADIUS policy (optional).

      For example:

    • Unique IP and policy: myclient,1.2.3.4,secret123,f,f,mypolicy

    • Subnet and no policy: myclients,1.2.4.0/24,secret123,t,t,

    • IP range and policy: myotherclients,1.2.5.10-1.2.5.19,secret123,t,f,mypolicy

  3. Click OK.