802.1x authentication

To control network access, the FortiSwitch unit supports IEEE 802.1x authentication. A supplicant connected to a port on the switch must be authenticated by a RADIUS server to gain access to the network. The supplicant and the authentication server communicate using the switch using EAP. The FortiSwitch unit supports EAP-PEAP, EAP-TTLS, EAP-TLS, and EAP-MD5.

To use the RADIUS server for authentication, you must configure the server before configuring the users or user groups on the FortiSwitch unit.

The FortiSwitch unit implements MAC-based authentication. The switch saves the MAC address of each supplicantʼs device. The switch provides network access only to devices that have successfully been authenticated.

The FortiSwitch unit supports up to 20 devices per port for 802.1x MAC-based authentication. System-wide, the FortiSwitch unit now supports a total of 10 times the number of interfaces for 802.1x MAC-based authentication:

Model	Total number of devices supported per switch
108	80
112	120
124/224/424/524/1024	240
148/248/448/548/1048	480
3032	320

You can enable the MAC Authentication Bypass (MAB) option for devices (such as network printers) that cannot respond to the 802.1x authentication request. With MAB enabled on the port, the system will use the device MAC address as the user name and password for authentication.

Optionally, you can configure a guest VLAN for unauthorized users, a VLAN for users whose authentication was unsuccessful, and a VLAN for users when the authentication server is unavailable.

When the authentication server is unavailable after the server timeout period expires:

• You can control how many seconds the authentication server tries to authenticate users for before assigning them to the specified VLAN:

  config switch interface

  edit <interface_name>

  config port-security

  set port-security-mode {802.1X | 802.1X-mac-based}

  set authserver-timeout-period <3-15 seconds>

  set authserver-timeout-vlan {enable | disable}

  set authserver-timeout-vlanid <1-4094>

  end

  set security-groups <security-group-name>

  next

  end

• You can control how often the server checks if the RADIUS server is available:

  config user radius

  edit <RADIUS_user_name>

  set link-monitor {enable | disable}

  set link-monitor-interval <5-120 seconds>

  next

  end

When you are testing your system configuration for 802.1x authentication, you can use the monitor mode to allow network traffic to flow, even if there are configuration problems or authentication failures.

This chapter covers the following topics:

• Dynamic VLAN assignment
• MAC authentication bypass (MAB)
• Configuring global settings
• Configuring the 802.1x settings on an interface
• Viewing the 802.1x details
• Clearing port authorizations
• Authenticating users with a RADIUS server
• Authenticating an admin user with RADIUS
• RADIUS accounting and FortiGate RADIUS single sign-on
• RADIUS change of authorization (CoA)
• Use cases
• Detailed deployment notes

Dynamic VLAN assignment

You can configure the RADIUS server to return a VLAN in the authentication reply message:

1. On the FortiSwitch unit, select port-based authentication or MAC-based authentication and a security group.
2. On the RADIUS server, configure the attributes.

Using the GUI:

1. Go to Switch > Interface > Physical.
2. Select a port and then select Edit.
   
3. Select 802.1X for port-based authentication or select 802.1X-MAC-based for MAC-based authentication.
   
   
   
4. Select one or more security groups.
5. Select OK.

Using the CLI:

To select port-based authentication and the security group on the FortiSwitch unit:

config switch interface

edit <interface_name>

config port-security

set port-security-mode 802.1X

end

set security-groups <security-group-name>

end

The FortiSwitch unit will change the native VLAN of the port to that of the VLAN from the server.

To select MAC-based authentication and the security group on the FortiSwitch unit:

config switch interface

edit <interface_name>

config port-security

set port-security-mode 802.1X-mac-based

end

set security-groups <security-group-name>

end

Here, the switch assigns the returned VLAN only to this userʼs MAC address. The native VLAN of the port remains unchanged.

Use the following configuration command to view the MAC-based VLAN assignments:

diagnose switch vlan assignment mac list [sorted-by-mac | sorted-by-vlan]

Configure the following attributes in the RADIUS server:

• Tunnel-Private-Group-Id—VLAN ID or name (10)
• Tunnel-Medium-Type—IEEE-802 (6)
• Tunnel-Type—VLAN (13)

NOTE: If the Tunnel-Private-Group-Id attribute is set to the VLAN name, the same string must be specified in the set description command under the config switch vlan command. For example:

config switch vlan

edit 100

set description "local_vlan"

next

end

MAC authentication bypass (MAB)

Devices such as network printers, cameras, and sensors might not support 802.1x authentication. If you enable the MAB option on the port, the system will use the device MAC address as the user name and password for authentication.

MAB retries authentication three times before the device is assigned to a guest VLAN for unauthorized users. By default, reauthentication is disabled. Use the following commands if you want to change the default behavior:

config switch global

config port-security

set mab-reauth enable

end

You must provision the RADIUS server to authenticate the devices that use MAB, either by adding the MAC addresses as regular users or by implementing additional logic to resolve the MAC addresses in a network inventory database.

The following flowchart shows the FortiSwitch 802.1x port-based authentication with MAB enabled:

The following flowchart shows the FortiSwitch 802.1x MAC-based authentication with MAB enabled:

Configuring global settings

To select which 802.1x certificate and certificate authority that the FortiSwitch unit uses, see SSL configuration.

If a link goes down, you can select whether the impacted devices must reauthenticate. If reauthentication is unnecessary, select Do Not Require Re-Authentication. To revert all devices to the unauthenticated state and force each device to reauthenticate, select Require Re-Authentication.

MAB retries authentication before assigning a device to a guest VLAN for unauthorized users. MAB is disabled by default in the CLI.

The Re-Authentication Period (Minutes) field defines how often the device needs to reauthenticate (that is, if a session remains active beyond this number of minutes, the system requires the device to reauthenticate). Set the value to 0 to disable reauthentication.

If 802.1x authentication fails, the Maximum Re-Authentication Attempts field caps the number of attempts that the system will initiate. Set the value to 0 to disable the reauthentication attempts.

Using the GUI:

1. Go to Switch > Interface > Port Security.
   
   
2. Select Require Reauthentication to revert all devices to the unauthenticated state if the link goes down or select Do Not Require Reauthentication if reauthentication is unnecessary if the link goes down.
3. In the Re-Authentication Period (Minutes) field, enter the number of minutes before the system requires the device to reauthenticate.
4. In the Maximum Re-Authentication Attempts field, enter the maximum number of times that the system tries to reauthorize the session.
5. Select Update.

Using the CLI:

config switch global

config port-security

set link-down-auth {no-action | set-unauth}

set mab-reauth {enable | disable}

set max-reauth-attempt <0-15>

set reauth-period <0-1440>

end

NOTE: Changes to global settings only take effect when new 802.1x/MAB sessions are created.

Configuring the 802.1x settings on an interface

Using the GUI:

1. Go to Switch > Interface > Physical.
2. Select a port and then select Edit.
   
   
3. Select 802.1X for port-based authentication or select 802.1X-MAC-based for MAC-based authentication.
   The Port Security section displays additional options.
   
   
4. Select MAC Auth Bypass.
5. Select EAP Pass-Through Mode.
   NOTE: EAP Pass-Through Mode is enabled by default, which is the recommended setting. If the RADIUS authentication server does not support EAP-TLS, the EAP Pass-Through Mode needs to be disabled.
6. Select Frame VLAN Apply to apply the EAP/MAB frame VLAN to the port native VLAN.
   NOTE: For phone and PC configuration only, clear the checkbox to preserve the native VLAN when the data traffic is expected to be untagged.
7. Select Open Authentication to enable open authentication (monitor mode) on this interface. Use the monitor mode to test your system configuration for 802.1x authentication. You can use monitor mode to test port-based authentication, MAC-based authentication, EAP pass-through mode, and MAC authentication bypass. After you enable monitor mode, the network traffic will continue to flow, even if the users fail authentication.
8. Select Guest VLAN if you want to assign a VLAN to unauthorized users. If you select Guest VLAN, enter the guest VLAN identifier in the Guest VLAN ID field and enter the number of seconds for an unauthorized user to have access as a guest before authorization fails in the Guest Auth Delay field.
9. Select Auth Fail VLAN if you want to assign a VLAN to users who attempted to authenticate but failed to provide valid credentials. If you select Auth Fail VLAN, enter the VLAN identifier in the Auth Fail VLAN ID field.
10. If you want to use the RADIUS-provided reauthentication time, select RADUS Session Timeout.
11. If you are using port-based authentication or MAC-based authentication, select one or more security groups.
12. Select OK.

Using the CLI:

config switch interface

edit <port>

config port-security

set port-security-mode {none | 802.1X | 802.1X-mac-based}

set framevid-apply {disable | enable}

set auth-fail-vlan {enable | disable}

set auth-fail-vlanid <vlanid>

set authserver-timeout-period <3-15>

set authserver-timeout-vlan {enable | disable}

set authserver-timeout-vlanid <1-4094>

set eap-passthru {enable | disable}

set guest-auth-delay <integer>

set guest-vlan {enable | disable}

set guest-vlanid <vlanid>

set mac-auth-bypass {enable | disable}

set open-auth {enable | disable}

set radius-timeout-overwrite {enable | disable}

end

set security-groups <security-group-name>

end

Viewing the 802.1x details

Using the GUI:

Go to Switch >Monitor > 802.1x Status.

Using the CLI:

Use the following command to show diagnostics on one or all ports:

diagnose switch 802-1x status [<port>]

port3 : Mode: port-based (MAC by-pass disable)
	Link: Link up
	Port State: authorized
	Dynamic Authorized Vlan: 10
	Native vlan: 10
	Allowed vlan list: 1-10
	Untagged vlan list:
	Guest vlan: 
	AuthFail vlan: 

	Sessions info:
	STA=00:24:9b:1b:20:65 Type=802.1X EAP PEAP state=AUTHENTICATED

port7 : Mode: mac-based (mac-by-pass disable) 
	Link: Link up
	Port State: authorized ( ) 
	EAP pass-through mode : Enable
	Native Vlan : 1
	Allowed Vlan list: 1
	Untagged Vlan list: 1
	Guest VLAN :

	Client MAC Type Vlan Dynamic-Vlan
	0a:0a:0b:0b:0a:0a 802.1x 1 0
	0a:0a:0b:0b:0a:09 802.1x 1 0
	0a:0a:0b:0b:0a:08 802.1x 1 0
	0a:0a:0b:0b:0a:07 802.1x 1 0
	0a:0a:0b:0b:0a:06 802.1x 1 0
	0a:0a:0b:0b:0a:05 802.1x 1 0
	0a:0a:0b:0b:0a:04 802.1x 1 0
	0a:0a:0b:0b:0a:03 802.1x 1 0
	0a:0a:0b:0b:0a:02 802.1x 1 0
	0a:0a:0b:0b:0a:01 802.1x 1 0

	Sessions info:
	0a:0a:0b:0b:0a:0a Type=802.1x,MD5,state=AUTHENTICATED,etime=2,eap_cnt=3 params:reAuth=3600
	0a:0a:0b:0b:0a:09 Type=802.1x,MD5,state=AUTHENTICATED,etime=2,eap_cnt=3 params:reAuth=3600
	0a:0a:0b:0b:0a:08 Type=802.1x,MD5,state=AUTHENTICATED,etime=2,eap_cnt=3 params:reAuth=3600
	0a:0a:0b:0b:0a:07 Type=802.1x,MD5,state=AUTHENTICATED,etime=2,eap_cnt=3 params:reAuth=2896
	0a:0a:0b:0b:0a:06 Type=802.1x,MD5,state=AUTHENTICATED,etime=2,eap_cnt=3 params:reAuth=3600
	0a:0a:0b:0b:0a:05 Type=802.1x,MD5,state=AUTHENTICATED,etime=2,eap_cnt=3 params:reAuth=3600
	0a:0a:0b:0b:0a:04 Type=802.1x,MD5,state=AUTHENTICATED,etime=2,eap_cnt=3 params:reAuth=3600
	0a:0a:0b:0b:0a:03 Type=802.1x,MD5,state=AUTHENTICATED,etime=2,eap_cnt=3 params:reAuth=3600
	0a:0a:0b:0b:0a:02 Type=802.1x,MD5,state=AUTHENTICATED,etime=2,eap_cnt=3 params:reAuth=3600
	0a:0a:0b:0b:0a:01 Type=802.1x,MD5,state=AUTHENTICATED,etime=2,eap_cnt=3 params:reAuth=3600h=120

Clearing port authorizations

Using the GUI:

1. Go to Switch > Interface > Physical.
2. Select one or more ports that you want to clear the authorization from.
3. Select Clear Auth.

Using the CLI:

execute 802-1x clear interface <port>

Authenticating users with a RADIUS server

Using the GUI:

1. Define the RADIUS server:
   1. Go to System > Authentication > RADIUS.
   2. Select Add Server.
      
      
      
   3. In the Name field, enter a name for the RADIUS server.
   4. In the Primary Server Address field, enter the IP address for the RADIUS server.
   5. In the Primary Server Secret field, enter a password to use as a RADIUS key.
   6. Select Add.
2. Create a user group:
   1. Go to System > User > Group.
   2. Select Add Group.
      
      
      
   3. In the Name field, enter a name for the user group.
   4. Select Add Server.
   5. Select the name of the RADIUS server that you configured in step 1.
   6. Select Add Group.
3. Configure the port security:
   1. Go to Switch > Interface > Physical.
   2. Select a port and then select Edit.
      
   3. Select 802.1X for port-based authentication or select 802.1X-MAC-based for MAC-based authentication.
      
      
      
   4. Select the user group that you configured in step 2.
      
      
      
   5. Select OK.

Using the CLI:

1. Define an IPv4 or IPv6 RADIUS server:

   config user radius

   edit <name>

   set addr-mode ipv4

   set server <IPv4_address>

   set source-ip <ipv4_address>

   set radius-port <radius_port_num>

   set secret <server_password>

   set auth-type {auto | chap | ms_chap | ms_chap_v2 | pap}

   set nas-ip <IPv4_address>

   set all-usergroup {enable | disable}

   set link-monitor {enable | disable}

   set link-monitor-interval <5-120 seconds>

   end

   end

   config user radius

   edit <name>

   set addr-mode ipv6

   set server <IPv6_address>

   set source-ip6 <ipv6_address>

   set radius-port <radius_port_num>

   set secret <server_password>

   set auth-type {auto | chap | ms_chap | ms_chap_v2 | pap}

   set nas-ip6 <IPv6_address>

   set all-usergroup {enable | disable}

   set link-monitor {enable | disable}

   set link-monitor-interval <5-120 seconds>

   end

   end

2. Create a user group:

   config user group

   edit <name>

   set member <list>

   config match

   edit 1

   set group-name <name>

   set server-name <name>

   end

   end

   end

   end

3. Configure the switch interface for port-based or MAC-based 802.1x authentication:

   config switch interface

   edit <interface>

   config port-security

   set port-security-mode 802.1X

   end

   set security-groups <security-group-name>

   end

   end

   config switch interface

   edit <interface>

   config port-security

   set port-security-mode 802.1X-mac-based

   end

   set security-groups <security-group-name>

   end

   end

Example: RADIUS user group

Using the GUI:

1. Define the RADIUS server:
   1. Go to System > Authentication > RADIUS.
   2. Select Add Server.
      
   3. In the Name field, enter FortiAuthenticator.
   4. In the Primary Server Address field, enter 10.160.36.190.
   5. In the Primary Server Secret field, enter 6rF7O4/Zf3p2TutNyeSjPbQc73QrS21wNDmNXd/rg9k6nTR6yMhBRsJGpArhle6UOCb7b8InM3nrCeuVETr/a02LpILmIltBq5sUMCNqbR6zp2fS3r35Eyd3IIrzmve4Vusi52c1MrCqVhzzy2EfxkBrx5FhcRQWxStvnVt4+dzLYbHZ.
      
      
      
   6. Select Add.
2. Create a user group:
   1. Go to System > User > Group.
   2. Select Add Group.
      
   3. In the Name field, enter Radius_group.
   4. Select Add Server.
   5. Select FortiAuthenticator as the authentication server.
      
      
      
   6. Select Add Group.
3. Configure the port security:
   1. Go to Switch > Interface > Physical.
   2. Select the port1 row and then select Edit.
      
      
      
   3. In the Allowed VLANs field, enter 1.
   4. Select 802.1X.
      
   5. Select Radius_group.
      
      
      
   6. Select OK.

Using the CLI:

1. Define the RADIUS server:

   config user radius

   edit "FortiAuthenticator"

   set secret ENC 6rF7O4/Zf3p2TutNyeSjPbQc73QrS21wNDmNXd/rg9k6nTR6yMhBRsJGpArhle6UOCb7b8InM3nrCeuVETr/a02LpILmIltBq5sUMCNqbR6zp2fS3r35Eyd3IIrzmve4Vusi52c1MrCqVhzzy2EfxkBrx5FhcRQWxStvnVt4+dzLYbHZ

   set server “10.160.36.190”

   set addr-mode ipv4

   next

   end

2. Create a user group:

   config user group

   edit "Radius_group"

   set member "FortiAuthenticator"

   end

   end

3. Configure the port security:

   config switch interface

   edit "port1"

   set allowed-vlans 1

   config port-security

   set port-security-mode 802.1X

   end

   set security-groups "Radius_group"

   end

   end

Example: dynamic VLAN

To assign VLAN dynamically for a port on which a user is authenticated, configure the RADIUS server attributes to return the VLAN ID when the user is authenticated. Assuming that the port security mode is set to 802.1X, the FortiSwitch unit will change the native VLAN of the port to the value returned by the server.

Ensure that the following attributes are configured on the RADIUS server:

• Tunnel-Private-Group-Id <integer or string> (the VLAN ID or VLAN name)
• Tunnel-Medium-Type IEEE-802 (6)
• Tunnel-Type VLAN (13)

NOTE: If the Tunnel-Private-Group-Id is set to the VLAN name, the same string must be specified in the set description command under the config switch vlan command.

Authenticating an admin user with RADIUS

If you want to use a RADIUS server to authenticate administrators, you must configure the authentication before you create the administrator accounts. Do the following:

1. Configure the FortiSwitch unit to access the RADIUS server.
2. Configure an administrator to authenticate with a RADIUS server and match the user secret to the RADIUS server entry.
3. Create the RADIUS user group.

Using the GUI:

1. Create a RADIUS system admin group:
   1. Go to System > Admin > Administrators.
   2. Select Add Administrator.
      
   3. In the Name field, enter RADIUS_Admins.
   4. Select Remote.
   5. For the user group, select Radius_group.
   6. Select Wildcard.
   7. For the admin profile, select super_admin.
      
      
      
   8. Select Add.
2. Create a user:
   1. Go to System > User > Definition.
   2. Select Add User.
      
   3. In the User Name field, enter RADIUS1.
   4. Select Password from the Type field.
   5. In the Password field and Confirm Password field, enter 6rF7O4/Zf3p2TutNyeSjPbQc73QrS21wNDmNXd/rg9k6nTR6yMhBRsJGpArhle6UOCb7b8InM3nrCeuVETr/a02LpILmIltBq5sUMCNqbR6zp2fS3r35Eyd3IIrzmve4Vusi52c1MrCqVhzzy2EfxkBrx5FhcRQWxStvnVt4+dzLYbHZ.
      
      
      
   6. Select Add.
3. Create a user group:
   1. Go to System > User > Group.
   2. Select Add Group.
   3. In the Name field, enter RADIUS_Admins.
   4. Select RADIUS1 in the Available Users box and select the right arrow to move it to the Members box.
      
      
      
   5. Select Add Group.

Using the CLI:

1. Create a RADIUS system admin group:

   config system admin

   edit "RADIUS_Admins"

   set remote-auth enable

   set accprofile "super_admin"

   set wildcard enable

   set remote-group "RADIUS_Admins"

   next

   end

2. Create a user:

   config user radius

   edit "RADIUS1"

   set secret ENC 6rF7O4/Zf3p2TutNyeSjPbQc73QrS21wNDmNXd/rg9k6nTR6yMhBRsJGpArhle6UOCb7b8InM3nrCeuVETr/a02LpILmIltBq5sUMCNqbR6zp2fS3r35Eyd3IIrzmve4Vusi52c1MrCqVhzzy2EfxkBrx5FhcRQWxStvnVt4+dzLYbHZ

   set addr-mode ipv4

   next

   end

3. Create a user group:

   config user group

   edit "RADIUS_Admins"

   set member "RADIUS1"

   next

   end

RADIUS accounting and FortiGate RADIUS single sign-on

NOTE: To obtain a valid Framed-IP-Address attribute value, you need to manually configure DHCP snooping in the 802.1x-authenticated ports of your VLAN network for both port and MAC modes.

You can use your FortiSwitch unit for RADIUS single sign-on (RSSO) in two modes:

• Standalone mode
• FortiLink mode (FortiSwitch unit managed by FortiGate unit)

The FortiSwitch unit uses 802.1x-authenticated ports to send five types of RADIUS accounting messages to the RADIUS accounting server to support FortiGate RADIUS single sign-on:

• START—The FortiSwitch unit has been successfully authenticated, and the session has started.
• STOP—The FortiSwitch session has ended.
• INTERIM—Periodic messages sent based on the value set using the set acct-interim-interval command.
• ON—The FortiSwitch unit will send this message when the switch is turned on.
• OFF—The FortiSwitch unit will send this message when the switch is shut down.

NOTE: Starting in FortiSwitchOS 6.2.1, RADIUS accounting and CoA now support EAP and MAB 802.1x authentication.

Configuring the RADIUS accounting server and FortiGate RADIUS single sign-on

Use the following commands to set up RADIUS accounting and enable a FortiSwitch unit to receive CoA and disconnect messages from the RADIUS server:

config user radius

edit <RADIUS_server_name>

set acct-interim-interval <seconds>

set secret <secret_key>

set server <domain_ipv4_ipv6>

set addr-mode {ipv4 | ipv6}

set source-ip <ipv4_addr>

set source-ip6 <ipv6_addr>

config acct-server

edit <entry_ID>

set status {enable | disable}

set server <accounting_server>

set secret <secret_key>

set port <port_number>

next

end

next

end

Variable	Description
<RADIUS_server_name>	Enter the name of the RADIUS server that will be sending CoA and disconnect messages to the FortiSwitch unit. By default, the messages use port 3799.
acct-interim-interval <seconds>	Enter the number of seconds between each interim accounting message sent to the RADIUS server. The value range is 60-86400. The default is 600.
addr-mode {ipv4 | ipv6}	Select whether to connect to the RADIUS server with IPv4 or IPv6. The default is IPv4.
secret <secret_key>	Enter the shared secret key for authentication with the RADIUS server.
server <domain_ipv4_ipv6>	Enter the domain name, IPv4 address, or IPv6 address for the RADIUS server. There is no default.
source-ip <ipv4_addr>	If the addr-mode was set to ipv4, enter the IPv4 address of the server that will be sending accounting messages. The default is 0.0.0.0.
source-ip6 <ipv6_addr>	If the addr-mode was set to ipv6, enter the IPv6 address of the server that will be sending accounting messages. There is no default.
<entry_ID>	Enter the entry identifier. The value range is 0-20.
status {enable | disable}	Enable or disable RADIUS accounting. The default is disable.
server <accounting_server>	Enter the domain name, IPv4 address, or IPv6 address of the RADIUS server that will be receiving the accounting messages. There is no default value.
secret <secret_key>	Enter the shared secret key for the RADIUS accounting server.
port <port_number>	Enter the port number for the RADIUS accounting server to receive accounting messages from the FortiSwitch unit. The default is 1813.

Example: RADIUS accounting and single sign-on

Use the following commands to set up RADIUS accounting:

config user radius

edit "local-RADIUS"

set server 10.0.23.5

set addr-mode ipv4

set secret ENC LE8xetYYGiE0bkQpBDdH6acilwkYROCos7XK2q5cNPhu8sUDW9/fvkgE+fVURgZGEzTsndt41gb+K+zV9m+nXCnoUXqivzQdt1UNlMxgKXADnCpXuiY966aJsYigmW/AZ1IM5kweUxvuHK8eqJkkT0nl64c8DID/LMAcCTx6JMapRCBS

set auth-type ms_chap_v2

set acct-interim-interval 1200

set source-ip 10.105.142.19

config acct-server

edit 1

set status enable

set server 10.0.23.5

set secret ENC LE8xetYYGiE0bkQpBDdH6acilwkYROCos7XK2q5cNPhu8sUDW9/fvkgE+fVURgZGEzTsndt41gb+K+zV9m+nXCnoUXqivzQdt1UNlMxgKXADnCpXuiY966aJsYigmW/AZ1IM5kweUxvuHK8eqJkkT0nl64c8DID/LMAcCTx6JMapRCBS

set port 1813

next

end

next

end

RADIUS change of authorization (CoA)

NOTE: For increased security, each subnet interface that will be receiving CoA requests must be configured with the set allowaccess radius-acct command.

NOTE: Starting in FortiSwitchOS 6.2.1, RADIUS accounting and CoA support EAP and MAB 802.1x authentication.

The FortiSwitch unit supports two types of RADIUS messages:

• CoA messages to change session authorization attributes (such as data filters and the session-timeout setting) during an active session. To change the session timeout for an authenticated session, the CoA-Request message needs to use the IEEE session-timeout attribute.
• Disconnect messages (DMs) to flush an existing session. For MAC-based authentication, all other sessions are unchanged, and the port stays up. For port-based authentication, only one session is deleted.

RADIUS CoA messages use the following Fortinet proprietary attribute:

Fortinet-Host-Port-AVPair 42 string

The format of the value is as follows:

Attribute	Value	Description
Fortinet-Host-Port-AVPair	action=bounce-port	The FortiSwitch unit disconnects all sessions on a port. The port goes down for 10 seconds and then up again.
Fortinet-Host-Port-AVPair	action=disable-port	The FortiSwitch unit disconnects all session on a port. The port goes down until the user resets it.
Fortinet-Host-Port-AVPair	action=reauth-port	The FortiSwitch unit forces the reauthentication of the current session.

In addition, RADIUS CoA uses the session-timeout attribute:

Attribute	Value	Description
session-timeout	<session_timeout_value>	The FortiSwitch unit disconnects a session after the specified number of seconds of idleness. This value must be more than 60 seconds. NOTE: To use the session-timeout attribute, you must enable the set radius-timeoutoverwrite command first.

The FortiSwitch unit sends the following Error-Cause codes in RADIUS CoA-NAK and Disconnect-NAK messages:

Error Cause	Error Code	Description
Unsupported Attribute	401	This error is a fatal error, which is sent if a request contains an attribute that is not supported.
NAS Identification Mismatch	403	This error is a fatal error, which is sent if one or more NAS-Identifier Attributes do not match the identity of the NAS receiving the request.
Invalid Attribute Value	407	This error is a fatal error, which is sent if a CoA-Request or Disconnect-Request message contains an attribute with an unsupported value.
Session Context Not Found	503	This error is a fatal error if the session context identified in the CoA-Request or Disconnect-Request message does not exist on the NAS.

Configuring CoA and disconnect messages

Use the following commands to enable a FortiSwitch unit to receive CoA and disconnect messages from a RADIUS server:

config system interface

edit "mgmt"

set ip <address> <netmask>

set allowaccess <access_types>

set type physical

next

config user radius

edit <RADIUS_server_name>

set radius-coa {enable | disable}

set radius-port <port_number>

set secret <secret_key>

set server <server_name_ipv4_ipv6>

set addr-mode {ipv4 | ipv6}

end

Variable	Description
config system interface
ip <address> <netmask>	Enter the interface IP address and netmask.
allowaccess <access_types>	Enter the types of management access permitted on this interface. Valid types are as follows: http https ping snmp ssh telnet radius-acct. Separate each type with a space. You must include radius-acct to receive CoA and disconnect messages.
<RADIUS_server_name>	Enter the name of the RADIUS server that will be sending CoA and disconnect messages to the FortiSwitch unit. By default, the messages use port 3799.
config user radius
radius-coa {enable | disable}	Enable or disable whether the FortiSwitch unit will accept CoA and disconnect messages. The default is disable.
radius-port <port_number>	Enter the RADIUS port number. By default, the value is 1812.
secret <secret_key>	Enter the shared secret key for authentication with the RADIUS server.
server <server_name_ipv4_ipv6>	Enter the domain name, IPv4 address, or IPv6 address for the RADIUS server. There is no default.
addr-mode {ipv4 | ipv6}	Select whether to connect to the RADIUS server with IPv4 or IPv6.

Example: RADIUS CoA

The following example enables the FortiSwitch unit to receive CoA and disconnect messages from the specified RADIUS server:

config system interface

edit "mgmt"

set ip 10.105.4.14 255.255.255.0

set allowaccess ping https http ssh snmp telnet radius-acct

set type physical

next

config user radius

edit "Radius-188-200"

set radius-coa enable

set secret ENC +2NyBcp8JF3/OijWl/w5nOC++aDKQPWnlC8Ug2HKwn4RcmhqVYE+q07yI9eSDhtiIw63kR/oMBLGwFQoeZfOQWengIlGTb+YQo/lYJn1V3Nwp9sdkcblfyayfc9gTeqe+mFltKl5IWNI7WRYiJC8sxaF9Iyr2/l4hpCiVUMiPOU6fSrj

set server "10.105.188.200"

set addr-mode ipv4

next

end

Viewing the CoA configuration

Use the following command to check the CoA settings:

S524DF4K15000024 # diagnose user radius coa

90075.874 DAS: :radius_das_diag_handler:
RADIUS DAS Server List:
radius2:
Type: RADIUS_8021X, IP: 10.105.252.79,
Last CoA/DM Client IP Addr    : 10.105.252.79
Disc Reqs     : 2
Disc ACKs     : 1
Disc NAKs     : 1
CoA  Reqs     : 0
CoA  ACKs     : 0
CoA  NAKs     : 0
radius3:
Type: RADIUS_8021X, IP: 10.105.252.76,
Last CoA/DM Client IP Addr    :
Disc Reqs     : 0
Disc ACKs     : 0
Disc NAKs     : 0
CoA  Reqs     : 0
CoA  ACKs     : 0
CoA  NAKs     : 0

Use cases

Here are three use cases for 802.1x authentication.

Use case 1

In this use case, a Cisco phone uses MAB and uses LLDP-MED to assign the voice VLAN. A PC behind the Cisco phone uses 802.1x authentication with or without dynamic VLAN assignment.

The following is an example configuration:

config switch lldp profile

edit "lldp-cisco-104"

set 802.1-tlvs port-vlan-id

set 802.3-tlvs power-negotiation

config med-network-policy

edit "voice"

set assign-vlan enable

set status enable

set vlan 104

next

set med-tlvs inventory-management network-policy

next

end

config switch physical-port

edit "port1"

set lldp-profile "lldp-cisco-104"

next

end

config switch interface

edit "port1"

set native-vlan 20

set security-groups "CISEGRP"

set snmp-index 1

config port-security

set mac-auth-bypass enable // Required. You need to enable MAB.

set port-security-mode 802.1X-mac-based // Required

end

next

end

Use case 2

In this use case, the Cisco phone uses 802.1x authentication and uses LLDP-MED to assign the voice VLAN. A PC behind the Cisco phone uses 802.1x authentication without dynamic VLAN assignment.

RADIUS dynamic VLAN assignment for the voice VLAN must match the voice VLAN configured in the LLDP-MED profile for Cisco phone 802.1x authentication.

The following is an example configuration:

config switch lldp profile

edit "lldp-cisco-104"

set 802.1-tlvs port-vlan-id

set 802.3-tlvs power-negotiation

config med-network-policy

edit "voice"

set assign-vlan enable

set status enable

set vlan 104

next

set med-tlvs inventory-management network-policy

next

end

config switch physical-port

edit "port1"

set lldp-profile "lldp-cisco-104"

next

end

config switch interface

edit "port1"

set native-vlan 20

set security-groups "CISEGRP"

set snmp-index 1

config port-security

set mac-auth-bypass disable // Optional

set eap-auto-untagged-vlans disable // Required. Needed to allow voice traffic with voice VLAN tag at egress

set port-security-mode 802.1X-mac-based // Required

end

next

end

Use case 3

In this use case, the Cisco phone uses 802.1x authentication and uses LLDP-MED to assign the voice VLAN. The PC behind the Cisco phone uses 802.1x authentication with dynamic VLAN assignment.

RADIUS dynamic VLAN assignment for the voice VLAN has to match the voice VLAN configured in the LLDP-MED profile for Cisco phone 802.1x authentication.

The VLAN ID from the RADIUS dynamic VLAN assignment for the PC has to be added in the untagged VLAN list on the port.

The following is an example configuration:

config switch lldp profile

edit "lldp-cisco-104"

set 802.1-tlvs port-vlan-id

set 802.3-tlvs power-negotiation

config med-network-policy

edit "voice"

set assign-vlan enable

set status enable

set vlan 104

next

set med-tlvs inventory-management network-policy

next

end

config switch physical-port

edit "port1"

set lldp-profile "lldp-cisco-104"

next

end

config switch interface

edit "port1"

set native-vlan 20

set allowed-vlans 50 60 70 // Assume that VLANs 50, 60, and 70 are a part of the dynamic VLANs configured on RADIUS for PCs in different groups.

set untagged-vlans 50 60 70

set security-groups "CISEGRP"

set snmp-index 1

config port-security

set mac-auth-bypass disable // Optional

set eap-auto-untagged-vlans disable // Required. Needed to allow voice traffic with voice VLAN tag at egress

set port-security-mode 802.1X-mac-based // Required

end

next

end

Detailed deployment notes

• Using more than one security group (with the set security-groups command) per security profile is not supported.
• CoA and single sign-on are supported only by the CLI in this release.
• RADIUS CoA is supported in standalone mode and in non-NAT FortiLink mode.
• The FortiSwitch unit supports using FortiAuthenticator, FortiConnect, Microsoft Network Policy Server (NPS), Aruba ClearPass, and Cisco Identity Services Engine (ISE) as the RADIUS server for CoA and RSSO.
• Each RADIUS CoA server can support only one accounting manager in this release.
• RADIUS accounting/CoA/VLAN-by-name features are supported only with eap-passthru enable.
• Fortinet recommends a unique secret key for each accounting server.
• For CoA to correctly function with FortiAuthenticator or FortiConnect, you must include the User-Name attribute (you can optionally include the Framed-IP-Address attribute) or the User-Name and Calling-Station-ID attributes in the CoA request.
• To obtain a valid Framed-IP-Address attribute value, you need to manually configure DHCP snooping in the 802.1x-authenticated ports of your VLAN network for both port and MAC modes.
• Port-based basic statistics for RADIUS accounting messages are supported in the Accounting Stop request.
• By default, the accounting server is disabled. You must enable the accounting server with the set status enable command.
• The default port for FortiAuthenticator single sign-on is 1813 for the FortiSwitch unit.
• In MAC-based authentication, the maximum number of client MAC addresses is 20. Each model has its own maximum limit.
• Static MAC addresses and sticky MAC addresses are mechanisms for manual/local authorization; 802.1x is a mechanism for protocol-based authorization. Do not mix them.
• Fortinet recommends an 802.1x setup rate of 5 to 10 sessions per second.
• Starting in FortiSwitch 6.2.0, when 802.1x authentication is configured, the EAP pass-through mode (set eap-passthru) is enabled by default.
• For information about RADIUS attributes supported by FortiSwitchOS, refer to the “Supported attributes for RADIUS CoA and RSSO” appendix.
• The authentication and accounting server configuration must be in the same address mode within the same member. The address mode is either IPv4 or IPv6, no matter what the address mode is in the FQDN or raw IP address. The address mode cannot be mixed.
• When a client is authorized with the RADIUS timeout VLAN enabled, the client is placed in the authorization VLAN. If the RADIUS server becomes unavailable afterward and the reauthentication timer expires for the session, the device keeps the client in the authorization VLAN but the state changes from AUTHENTICATED to SERVER_TIMEOUT.
• In general for 802.1x deployment, Fortinet suggests disabling STP in the 802.1x security ports. If STP is enabled on the ports, the ports must be assigned to STP instances that belong to a dynamic VLAN, guest VLAN, or auth-fail VLAN; otherwise, the network connectivity fails after the ports are authorized and assigned to a dynamic VLAN, guest VLAN, or auth-fail VLAN.