Configuring the RADIUS server

This section shows how to configure the RADIUS server to accept port-based 802.1x authentication. This example shows how to install and configure RADIUS in Windows Server 2016.

1. Log in to the Windows Server 2016 that you plan to use as your RADIUS server.
2. Launch the Server Manager and select Manage from the top right.
3. Select Add Roles and Features to launch the wizard.
4. From the wizard page, select Network Policy and Access Services, as shown in the following figure:

   
   

5. Select Next and then select Finish to start the installation. No reboot is required.

   
   

6. After the installation is complete, select Tools from the Server Manager and then select Network Policy Server.
7. Right-click on RADIUS Clients and select New to display the new RADIUS client dialog box. Use the following procedure to configure the RADIUS clients:
   1. Select the Enable the RADIUS client checkbox.
   2. Enter a name for your RADIUS server, such as FGTAuth.
   3. Enter the IP address of the FortiGate unit that is used to access the RADIUS server. Typically, this is the interface in the FortiGate unit with the same network as the RADIUS server. Otherwise, this will be the IP address you have configured as the source-ip in the user RADIUS settings in FortiOS.
   4. In the Shared Secret area, keep Manual selected and enter a password in the Shared secret field. NOTE: This password must match the FortiGate RADIUS server settings.
   5. Select OK.

   

8. Under the Policies section of the NPS Snap-in, right-click Connection Request Policies and select New.
   • In the Overview tab, enter a name for the policy, such as FGTAUth.
   • Select the Policy enabled check box.
   • Leave the type of network access server as Unspecified.
   
   

   

9. Select the Conditions tab.
   1. Select Add and then select the Client IPv4 Address condition.
   2. Select Add again and enter the IP address of the RADIUS client, which is the IP address of the FortiSwitch unit.
   3. Enable the NAT to the firewall policy from the FortiLink interface to the interface in which the RADIUS server is routed. In this example, it is the wan1 interface with an IP address of 172.17.96.6.
   
   

   

10. Select the Settings tab.
    1. Select Vendor Specific and then select Add.
    2. Scroll to the very bottom of the list and select Vendor-Specific.
    3. Select Add.
    
    

    

11. Configure a network policy.
    1. From the Network Policy Server Snap-in, right-click on Network Policies and select New.
    2. Enter a name for the policy, such as FGTAuth.
    3. On the Overview tab, make sure that Policy enabled checkbox is selected.
    4. Verify that Grant access is selected.
    5. Verify that the type of network access server is set to Unspecified.
    
    

    

12. Select the Conditions tab.
    1. Select Add.
    2. Select Windows Groups and then select Add.
    3. Select Add Groups.
    4. Enter the name of the group in AD that you want to allow for 802.1x connections.
    5. Select OK.
    
    

    

    
    

    

13. In the Constraints tab, verify that the following check boxes are selected, select Apply, and then select OK to complete the policy.
    
    

    

14. To verify the server certificate used by Microsoft Protocol EAP (PEAP), select Edit, and then select the certificate for the server to prove its identity to the client.
    
    

    

15. Download the certificate that you selected and save it in the Trusted Root Certificate Authorities directory of the local PC.
    
    

    

16. Under Certification Authority (Local), make certain that the settings match those in the following figure. Otherwise, you will receive an authentication failure with the following reason: “The client could not be authenticated because the Extensible Authentication Protocol (EAP) Type cannot be processed by the server.”
    

    

Troubleshooting

The best way to troubleshoot 802.1x connections is by looking at the Event Viewer of the Windows Server. Under Server Roles, check the output of the Network Policy and Access Services.

The following figure shows the successful output of an 802.1x connection from the PC:

Issue 1: The certificate chain was issued by an authority that is not trusted.

To fix this issue, import the CA certificate into the local machine and add it to the Trusted Root Certification Authorities.

Issue 2: The specified user does not exist.

To fix this issue, under Advanced settings, you can specify whether you want user authentication, computer authentication, or both.