Clients

You must configure each device requesting authorization from the RADIUS server as a FortiAuthenticator RADIUS client.

RADIUS accounting clients can be managed from Authentication > RADIUS Service > Clients.

Configured clients are assigned to one or more RADIUS policies that determine the authentication logic.

To configure a RADIUS client:

1. Go to Authentication > RADIUS Service > Clients, and click Create New to add a new RADIUS client.
   The Create New Authentication Client window opens.
2. Provide the following information to configure the client:

   Subnets and IP ranges can be defined in the Client address field. All authentication clients within a defined subnet/IP range will share the same configuration and shared secret. For example, 192.168.0.0/24 would allow all 255 IP addresses to authenticate. This saves time because it only uses a single client entry in the license table.

   Name	A name to identify the authentication client.
   Client address	The IP/Hostname, Subnet, or Range of the client.
   Secret	The RADIUS passphrase shared with the client.
   RADIUS attribute for user IP	Enter the radius attribute for the user IP address. Framed-IP-Address is the default RADIUS attribute.
   RADIUS attribute for user's device MAC address	Enter the can RADIUS attribute for the user MAC IP address. Calling-Station-Id is the default RADIUS attribute.
   Require client to send Message-Authenticator attribute	When FortiAuthenticator is the RADIUS server and the option is enabled, the RADIUS client must include the message authenticator attribute in the RADIUS authentication requests. Otherwise, FortiAuthenticator discards the RADIUS authentication requests.
   Accept RADIUS account messages for usage enforcement	Allows FortiAuthenticator to accept RADIUS accounting messages for usage enforcement. In order to accept account messages for enforcement, the client address must be set as an IP/Hostname. Subnet and Range client address types are not supported.
   Support RADIUS Disconnect messages	Allows FortiAuthenticator to support RADIUS Disconnect messages. In order to support RADIUS disconnect messages, the client address must be set as an IP/Hostname. Subnet and Range client address types are not supported.

3. Select Save to add the new RADIUS client.
   

   If authentication fails, check that the authentication client is configured and that its IP address is correctly specified. Common causes of problems are: RADIUS packets sent from an unexpected interface, or IP address. NAT performed between the authentication client and FortiAuthenticator.

To import RADIUS clients:

1. Go to Authentication > RADIUS Service > Clients, and click Import.

   The Import RADIUS Clients window opens.

2. Click Upload a file and choose the file location of the CSV file containing your RADIUS client list.

   Each line of the CSV file must contain values in the following format:

   • Name: String (the same character restrictions as in the GUI).

   • Address: IP address, subnet, or IP range.

   • Secret: String (the same character restrictions as in the GUI).

   • RADIUS attribute for user IP: String (the same character restrictions as in the GUI).

   • RADIUS attribute for user's device MAC address: String (the same character restrictions as in the GUI).

   • Accept RADIUS accounting messages for usage enforcement: Boolean ('t' or 'f').

   • Support RADIUS Disconnect messages: Boolean ('t' or 'f').

   • Policy: Name of a RADIUS policy (optional).

     For example:

   • Unique IP and policy: myclient,1.2.3.4,secret123,f,f,mypolicy

   • Subnet and no policy: myclients,1.2.4.0/24,secret123,t,t,

   • IP range and policy: myotherclients,1.2.5.10-1.2.5.19,secret123,t,f,mypolicy

3. Click Save.