You must configure each device requesting authorization from the RADIUS server as a FortiAuthenticator RADIUS client.
RADIUS accounting clients can be managed from Authentication > RADIUS Service > Clients.
Configured clients are assigned to one or more RADIUS policies that determine the authentication logic.
- Go to Authentication > RADIUS Service > Clients, and click Create New to add a new RADIUS client.
The Create New Authentication Client window opens.
- Provide the following information to configure the client:
Subnets and IP ranges can be defined in the Client address field. All authentication clients within a defined subnet/IP range will share the same configuration and shared secret. For example, 192.168.0.0/24 would allow all 255 IP addresses to authenticate. This saves time because it only uses a single client entry in the license table.
- Select OK to add the new RADIUS client.
If authentication fails, check that the authentication client is configured and that its IP address is correctly specified. Common causes of problems are:
- RADIUS packets sent from an unexpected interface, or IP address.
- NAT performed between the authentication client and FortiAuthenticator.
- Go to Authentication > RADIUS Service > Clients, and click Import.
The Import RADIUS Clients window opens.
- Click Upload a file and choose the file location of the CSV file containing your RADIUS client list.
Each line of the CSV file must contain values in the following format:
Name: String (the same character restrictions as in the GUI).
Address: IP address, subnet, or IP range.
Secret: String (the same character restrictions as in the GUI).
Accept RADIUS accounting messages for usage enforcement: Boolean ('t' or 'f').
Support RADIUS Disconnect messages: Boolean ('t' or 'f').
Policy: Name of a RADIUS policy (optional).
Unique IP and policy:
Subnet and no policy:
IP range and policy:
- Click OK.