Configure RADIUS settings

This view is used to configure FortiNAC to proxy 802.1x EAP. The following functions can be modified:

• RADIUS proxy service (enabled by default)
• Authentication/Accounting ports
• RADIUS server profiles
• RADIUS server defaults
• RADIUS domain mappings

RADIUS Proxy port configuration

Allows the RADIUS proxy service to be disabled or the Authentication and Accounting ports to be changed. These ports are independent of each other. This enables FortiNAC to proxy Accounting traffic while processing Authentication requests locally when device models are configured for Local RADIUS Authentication Mode.

RADIUS Server profiles

The first RADIUS Server added becomes the primary server by default. As more servers are added, you can modify which server is the primary.

The encryption method for user names and passwords passed between FortiNAC and the RADIUS server must be set to PAP. This affects the following accounts or user names and passwords created on the RADIUS server:

• The validation account created for communication with FortiNAC and entered in the RADIUS Server Profile configuration.
• Network users that access the network via the captive portal and are authenticated through RADIUS.
• Admin UI users authenticated through RADIUS.
• VPN Users authenticated through RADIUS.

You should be able to communicate with a RADIUS Server in order to add it to the list. For example, if a RADIUS Server is not currently connected to the network and FortiNAC cannot contact it, you will be asked if you want to add the server anyway.

1. Click Network > RADIUS
2. Click Proxy from the upper right hand corner.

Configure Proxy service

1. Modify the following as appropriate:
   • Authentication Port: Enables/disables the service and defines the authentication port for the RADIUS Proxy. Default: Enabled, 1812 (Cannot be set to the same port as Local RADIUS Authentication port)
   • Accounting Port: Enables/disables the service and defines the accounting port for the RADIUS Proxy. Default: Enabled, 1813
2. Click Save Settings. Changes to the configuration apply within 0-30 seconds.

Add a profile

1. Click Add.
2. Enter the parameters for the RADIUS Server profile.
3. Click the RADIUS Secret field to enter the RADIUS secret.
4. Enter the User Name.
5. Click the Password field to enter the Password information.

   Field	Definition
   Profile Name	Name displayed in the RADIUS server list.
   Host Name/IP address	Host name or IP address of the RADIUS server. If you are generating certificates using a NSRADIUS appliance, the Fully Qualified Domain Name is required.
   RADIUS Secret	Encryption key used by the RADIUS server to send authentication information.
   Authentication Port	Port number through which the RADIUS server communicates.
   Accounting Port	Port number that the RADIUS server uses for the accounting features, if they are used. If your RADIUS server does not use accounting features, leave the check box blank.
   Last Modified By	User name of the last user to modify the RADIUS Server.
   Last Modified Date	Date and time of the last modification to this RADIUS Server.
   Validation account
   User Name	User name for verifying access to the RADIUS Server. This field is required, but only used when there are multiple RADIUS Servers configured. You must create an account on the RADIUS Server that is used by FortiNAC to communicate with that Server. The encryption method must be set to PAP.
   Password	Password for verifying access to the RADIUS server. This field is required.

6. New servers are saved automatically.
   
7. Repeat as needed for additional RADIUS servers.

Modify a profile

1. Click Network > RADIUS > Proxy
2. Select the RADIUS Server profile and click Modify.
3. Make the changes. Changes are saved automatically.
   

Delete a profile

1. Click Network > RADIUS > Proxy
2. Select the RADIUS Server profile and click Delete.