Host name of switch

User name of supplicant or MAC address

User password of supplicant

Optional. The following settings are available:

• administrative—The user granted access to the administrative interface.

• authenticate-only—Authentication is requested, and no authentication information needs to be returned.

• call-check—This setting is used by the NAS in an Access-Request packet or Access-Accept packet to answer the call.

• callback-administrative—The user disconnected, called back, and granted access to the administrative interface.

• callback-framed—The user disconnected and called back and then used a Framed-Protocol attribute.

• callback-login—The user disconnected and called back.

• callback-nas-prompt—The user disconnected and called back and then provided a command prompt.

• framed—The user used a Framed-Protocol attribute.

• login—The user should be connected to a host.

• nas-prompt—The user provided a command prompt on the NAS.

• none—Disable the Service-Type AVP.

• outbound—The user granted access to outgoing devices.

The default is none for 802.1X authentication. MAC Authentication Bypass (MAB) always uses the call-check setting, no matter what is configured.

Configurable (size of bytes). The range of values is 600-1500. The default value is 1500.

Port connected to supplicant

Value of port ID; for example, 12 means port12

Ethernet (15)

MAC address of supplicant

Host name of switch

User name of supplicant or MAC address

Include EAP content

Configurable (size of bytes). The range of values is 600-1500. The default value is 1500.

Port connected to supplicant

Value of port ID; for example, 12 means port12

Ethernet (15)

MAC address of supplicant

The Message-Authenticator attribute is a checksum of the entire Access-Request packet, containing the Type, ID, Length, and Authenticator field; the shared secret is used as the key.

User name of supplicant (MAC address of host in MAB)

Whatever the server returns

Optional. Set to 13 for VLAN.

Optional. Set to 6 for IEEE-802.

VLAN number or VLAN name

Provides the VLAN identifier and controls whether egress packets are tagged.

Provides the VLAN name and controls whether egress packets are tagged.

Enables (1) the use of ingress filters. The use of ingress filters cannot be disabled.

Fortinet-Group-Name

Relayed from the server

1 for Start

802.1x or MAB session ID generated by the switch. For example: 0000004b

Host login name or MAC address. For example: host01

For example, e81cba8e8146 in MAC mode. This attribute cannot be used in port mode. The minimum value is 1; the maximum value is 1.

For example, S148EP591900009 for the host name of the switch.

This value is the host IP address if is found in the switch; otherwise, the switch does not send this attribute. For example: 100.1.0.3

This value is a text string that identifies the port of the NAS connected to the host. For example: port48

This value indicates the physical port number of the NAS. For example: 48

0 for asynchronous

MAC address of the 802.1x port. For example: E8-1C-BA-8E-81-46

MAC address of host. For example: 00-12-01-00-00-01

Time when the event occurred. For example: May 31, 2019 12:25:03.00000000 Pacific Daylight Time

Relayed from the server

Fortinet-Group-Name. Authentication fails if this value does not match.

3 for Interim-Update

802.1x or MAB session ID generated by the switch. For example: 0000004b

Host login name or MAC address. For example: host01

For example, e81cba8e8146 in MAC mode. This attribute cannot be used in port mode.

2 for two sessions on the port. This attribute is only valid for MAC mode.

For example, S148EP591900009 for the host name of the switch.

This value is the host IP address if is found in the switch; otherwise, the switch does not send this attribute. For example: 100.1.0.3

This value is a text string that identifies the port of the NAS connected to the host. For example: port48

This value indicates the physical port number of the NAS. For example: 48

15 for Ethernet

MAC address of the 802.1x port. For example: E8-1C-BA-8E-81-46

MAC address of host. For example: 00-12-01-00-00-01

Time when the event occurred. For example: May 31, 2019 12:25:03.00000000 Pacific Daylight Time

Eng-Group. If Filter-Id is received during authentication, it is included in accounting.

Whatever the server returns

2 for Stop

802.1x or MAB session ID generated by the switch. For example: 0000004b

Host login name or MAC address. For example: host01

For example, e81cba8e8146 in MAC mode. This attribute cannot be used in port mode.

2 for two sessions on the port

For example, S148EP591900009 for the host name of the switch.

This value is the host IP address if is found in the switch; otherwise, the switch does not send this attribute. For example: 100.1.0.3

This value is a text string that identifies the port of the NAS connected to the host. For example: port48

This value indicates the physical port number of the NAS. For example: 48

15 for Ethernet

MAC address of the 802.1x port. For example: E8-1C-BA-8E-81-46

MAC address of host. For example: 00-12-01-00-00-01

3200

16050448

20

93606

6 for Admin-Reset

Time when the event occurred. For example: May 31, 2019 12:25:03.00000000 Pacific Daylight Time

Eng-Group. If Filter-Id is received during authentication, it is included in accounting.

Whatever the server returns

MAC address of host

IP address of host

Host login name

NAS IP address

The Message-Authenticator attribute is a checksum of the entire Access-Request packet, containing the Type, ID, Length, and Authenticator field; the shared secret is used as the key.

Time when the event occurred. For example: May 31, 2019 12:25:03.00000000 Pacific Daylight Time

MAC address of host

Port that the host is connected to

802.1x or MAB session identifier generated by the switch

IP address of host

Host login name

MAC address of host

The Message-Authenticator attribute is a checksum of the entire Access-Request packet, containing the Type, ID, Length, and Authenticator field; the shared secret is used as the key.

Fortinet-Group-Name

Time when the event occurred. For example: May 31, 2019 12:25:03.00000000 Pacific Daylight Time

MAC address of host

Host login name

NAS IP address

The Message-Authenticator attribute is a checksum of the entire Access-Request packet, containing the Type, ID, Length, and Authenticator field; the shared secret is used as the key.

Fortinet-Group-Name

Time when the event occurred. For example: May 31, 2019 12:25:03.00000000 Pacific Daylight Time

Whatever the server returns

MAC address of host

Host login name

The Message-Authenticator attribute is a checksum of the entire Access-Request packet, containing the Type, ID, Length, and Authenticator field; the shared secret is used as the key.

Fortinet-Group-Name

Time when the event occurred. For example: May 31, 2019 12:25:03.00000000 Pacific Daylight Time

Whatever the server returns

MAC address of host

Port that the host is connected to

802.1x or MAB session identifier generated by the switch

IP address of host

Time when the event occurred. For example: May 31, 2019 12:25:03.00000000 Pacific Daylight Time

Refer to the “Error-Cause codes in RADIUS CoA-NAK and Disconnect-NAK messages” table in this appendix for a listing of error causes, error codes, and descriptions.

Time when the event occurred. For example: May 31, 2019 12:25:03.00000000 Pacific Daylight Time

This error is a fatal error, which is sent if a request contains an attribute that is not supported.

This error is a fatal error, which is sent if one or more NAS-Identifier Attributes do not match the identity of the NAS receiving the request.

This error is a fatal error, which is sent if a CoA-Request or Disconnect-Request message contains an attribute with an unsupported value.

The system has been idle for too long.

The user requested the service to be stopped.

The session has timed out.