Fortinet black logo

Administration Guide

Configure RADIUS settings

Copy Link
Copy Doc ID dc02a854-ab11-11ea-8b7d-00505692583a:938271
Download PDF

Configure RADIUS settings

This view is used to configure FortiNAC to proxy 802.1x EAP. The following functions can be modified:

  • RADIUS proxy service (enabled by default)
  • Authentication/Accounting ports
  • RADIUS server profiles
  • RADIUS server defaults
  • RADIUS domain mappings

RADIUS Proxy port configuration

Allows the RADIUS proxy service to be disabled or the Authentication and Accounting ports to be changed. These ports are independent of each other. This enables FortiNAC to proxy Accounting traffic while processing Authentication requests locally when device models are configured for Local RADIUS Authentication Mode.

RADIUS Server profiles

The first RADIUS Server added becomes the primary server by default. As more servers are added, you can modify which server is the primary.

The encryption method for user names and passwords passed between FortiNAC and the RADIUS server must be set to PAP. This affects the following accounts or user names and passwords created on the RADIUS server:

  • The validation account created for communication with FortiNAC and entered in the RADIUS Server Profile configuration.
  • Network users that access the network via the captive portal and are authenticated through RADIUS.
  • Admin UI users authenticated through RADIUS.
  • VPN Users authenticated through RADIUS.

You should be able to communicate with a RADIUS Server in order to add it to the list. For example, if a RADIUS Server is not currently connected to the network and FortiNAC cannot contact it, you will be asked if you want to add the server anyway.

  1. Click System > Settings.
  2. Expand the Authentication folder and click RADIUS. The RADIUS Servers window displays.

Configure Proxy service

  1. Modify the following as appropriate:
    • Authentication Port: Enables/disables the service and defines the authentication port for the RADIUS Proxy. Default: Enabled, 1812 (Cannot be set to the same port as Local RADIUS Authentication port)
    • Accounting Port: Enables/disables the service and defines the accounting port for the RADIUS Proxy. Default: Enabled, 1813
  2. Click Save Settings. Changes to the configuration apply within 0-30 seconds.

Add a profile

  1. Click Add.
  2. Enter the parameters for the RADIUS Server profile.
  3. Click the RADIUS Secret field to enter the RADIUS secret.
  4. Enter the User Name.
  5. Click the Password field to enter the Password information.

    Field

    Definition

    Profile Name

    Name displayed in the RADIUS server list.

    Host Name/IP address

    Host name or IP address of the RADIUS server.

    If you are generating certificates using a NSRADIUS appliance, the Fully Qualified Domain Name is required.

    RADIUS Secret

    Encryption key used by the RADIUS server to send authentication information.

    Authentication Port

    Port number through which the RADIUS server communicates.

    Accounting Port

    Port number that the RADIUS server uses for the accounting features, if they are used. If your RADIUS server does not use accounting features, leave the check box blank.

    Server Is NSRADIUS Appliance

    Indicates that this is a NSRADIUS Server. Check this box if you have purchased a NSRADIUS server as part of your FortiNAC configuration.

    Option displays only if a NSRADIUS license is installed on the FortiNAC or control server, and when there is no NSRADIUS Server already configured.

    REST API credentials are required for the Portal certificate page to generate and download certificates.

    REST API User

    User name for the admin user created on the NSRADIUS server. This user name will be used to communicate with the REST API on the NSRADIUS Server.

    It is recommended that you configure the REST API user.

    REST API Password

    Password for the NSRADIUS admin user that will allow the FortiNAC server to communicate with the REST API on the NSRADIUS Server.

    Appears when the Server Is NSRADIUS Appliance check box is selected.

    Last Modified By

    User name of the last user to modify the RADIUS Server.

    Last Modified Date

    Date and time of the last modification to this RADIUS Server.

    Validation account

    User Name

    User name for verifying access to the RADIUS Server. This field is required, but only used when there are multiple RADIUS Servers configured. You must create an account on the RADIUS Server that is used by FortiNAC to communicate with that Server. The encryption method must be set to PAP.

    Password

    Password for verifying access to the RADIUS server. This field is required.

  6. New servers are saved automatically.
  7. Repeat as needed for additional RADIUS servers.

Modify a profile

  1. Click System > Settings.
  2. Expand the Authentication folder and click RADIUS.
  3. Select the RADIUS Server profile and click Modify.
  4. Make the changes. Changes are saved automatically.

Delete a profile

  1. Click System > Settings.
  2. Expand the Authentication folder and click RADIUS.
  3. Select the RADIUS Server profile and click Delete.

Configure RADIUS settings

This view is used to configure FortiNAC to proxy 802.1x EAP. The following functions can be modified:

  • RADIUS proxy service (enabled by default)
  • Authentication/Accounting ports
  • RADIUS server profiles
  • RADIUS server defaults
  • RADIUS domain mappings

RADIUS Proxy port configuration

Allows the RADIUS proxy service to be disabled or the Authentication and Accounting ports to be changed. These ports are independent of each other. This enables FortiNAC to proxy Accounting traffic while processing Authentication requests locally when device models are configured for Local RADIUS Authentication Mode.

RADIUS Server profiles

The first RADIUS Server added becomes the primary server by default. As more servers are added, you can modify which server is the primary.

The encryption method for user names and passwords passed between FortiNAC and the RADIUS server must be set to PAP. This affects the following accounts or user names and passwords created on the RADIUS server:

  • The validation account created for communication with FortiNAC and entered in the RADIUS Server Profile configuration.
  • Network users that access the network via the captive portal and are authenticated through RADIUS.
  • Admin UI users authenticated through RADIUS.
  • VPN Users authenticated through RADIUS.

You should be able to communicate with a RADIUS Server in order to add it to the list. For example, if a RADIUS Server is not currently connected to the network and FortiNAC cannot contact it, you will be asked if you want to add the server anyway.

  1. Click System > Settings.
  2. Expand the Authentication folder and click RADIUS. The RADIUS Servers window displays.

Configure Proxy service

  1. Modify the following as appropriate:
    • Authentication Port: Enables/disables the service and defines the authentication port for the RADIUS Proxy. Default: Enabled, 1812 (Cannot be set to the same port as Local RADIUS Authentication port)
    • Accounting Port: Enables/disables the service and defines the accounting port for the RADIUS Proxy. Default: Enabled, 1813
  2. Click Save Settings. Changes to the configuration apply within 0-30 seconds.

Add a profile

  1. Click Add.
  2. Enter the parameters for the RADIUS Server profile.
  3. Click the RADIUS Secret field to enter the RADIUS secret.
  4. Enter the User Name.
  5. Click the Password field to enter the Password information.

    Field

    Definition

    Profile Name

    Name displayed in the RADIUS server list.

    Host Name/IP address

    Host name or IP address of the RADIUS server.

    If you are generating certificates using a NSRADIUS appliance, the Fully Qualified Domain Name is required.

    RADIUS Secret

    Encryption key used by the RADIUS server to send authentication information.

    Authentication Port

    Port number through which the RADIUS server communicates.

    Accounting Port

    Port number that the RADIUS server uses for the accounting features, if they are used. If your RADIUS server does not use accounting features, leave the check box blank.

    Server Is NSRADIUS Appliance

    Indicates that this is a NSRADIUS Server. Check this box if you have purchased a NSRADIUS server as part of your FortiNAC configuration.

    Option displays only if a NSRADIUS license is installed on the FortiNAC or control server, and when there is no NSRADIUS Server already configured.

    REST API credentials are required for the Portal certificate page to generate and download certificates.

    REST API User

    User name for the admin user created on the NSRADIUS server. This user name will be used to communicate with the REST API on the NSRADIUS Server.

    It is recommended that you configure the REST API user.

    REST API Password

    Password for the NSRADIUS admin user that will allow the FortiNAC server to communicate with the REST API on the NSRADIUS Server.

    Appears when the Server Is NSRADIUS Appliance check box is selected.

    Last Modified By

    User name of the last user to modify the RADIUS Server.

    Last Modified Date

    Date and time of the last modification to this RADIUS Server.

    Validation account

    User Name

    User name for verifying access to the RADIUS Server. This field is required, but only used when there are multiple RADIUS Servers configured. You must create an account on the RADIUS Server that is used by FortiNAC to communicate with that Server. The encryption method must be set to PAP.

    Password

    Password for verifying access to the RADIUS server. This field is required.

  6. New servers are saved automatically.
  7. Repeat as needed for additional RADIUS servers.

Modify a profile

  1. Click System > Settings.
  2. Expand the Authentication folder and click RADIUS.
  3. Select the RADIUS Server profile and click Modify.
  4. Make the changes. Changes are saved automatically.

Delete a profile

  1. Click System > Settings.
  2. Expand the Authentication folder and click RADIUS.
  3. Select the RADIUS Server profile and click Delete.