Wireless 802.1x EAP-TLS with user authentication

1. Configuring the certificates

Go to RADIUS Service > EAP and set up the EAP configuration.

If client certificates were not created by FortiAuthenticator, the 3rd-party server certificate would be uploaded on to FortiAuthenticator as a Trusted CA.

In this example, FortiAuthenticator creates the client certificates.

Go to Certificate Management > End Entities > Users and create a client certificate. The CN must match the AD user name.

Export the PKCS#12 file and passphrase protect it.

The client certificate can be pushed out using GPO (Group Policy Object). Otherwise, it can be imported manually.

2. Manually importing the client certificate – Windows 7

Manual import can be completed using MMC as shown.

Open Command Prompt and type mmc and hit Enter.

On the File menu, click Add/Remove Snap In.

Once imported, the certificate should show up under Local Computer and not Current User.

Export the FortiAuthenticator Certificate and Import that under Trusted Root Certification Authorities (again under Certificates (Local Computer)).

3. Configuring the FortiAuthenticator AD Server

Go to Authentication > Remote Auth. Servers > LDAP and create a new AD server.

Ensure that Username attribute matches the entry in the AD configuration in Step 1.

4. Configuring the user group

5. Configuring remote user sync rules

Go to Authentication > User Management > Remote User Sync Rules and configure a new Remote LDAP User Synchronization Rule.

Go to Authentication > User Management > Remote Users and check to see if the sync rule worked.

6. Configuring the FortiAuthenticator RADIUS client

7. Configuring the FortiWiFi

8. Results

In the Odyssey Access Client Manager, click Connect to the network. Once connected, the Status should read open and authenticated.

The authentication flow should initiate as soon as the supplicant makes a connection request.

Using tcpdump, FortiAuthenticator shows receipt of an Incoming Authentication Request (tcpdump host 10.1.2.27 -nnvvXs):

02:04:09.790423 IP (tos Ox0, ttl 64, id 9792, offset 0, flags [none], proto UDP (17), length 178) 
  10.1.2.27.1025 > 10.1.2.29.1812: [udp sum ok] RADIUS, length: 150 
    Access-Request (1), id: Ox9c, Authenticator: 874c50b16efbb87e593a5851e8361f10 
      User-Name Attribute (1), length: 6, Value: kash 
        0x0000: 6b61 7368
      NAS-IP-Address Attribute (4), length: 6, Value: 0.0.0.0 
        0x0000: 0000 0000 
      NAS-Port Attribute (5), length: 6, Value: 0 
        0x0000: 0000 0000 
      Called-Station-Id Attribute (30), length: 28, Value: 88-DC-96-27-72-6B:fortinet 
        0x0000: 3838 2d44 432d 3936 2d32 372d 3732 2d36 
        0x0010: 423a 666f 7274 696e 6574 
      Calling-Station-Id Attribute (31), length: 19, Value: 00-26-C6-6A-E6-B2 
        0x0000: 3030 2d32 362d 4336 2d36 412d 4536 2d42 
        0x0010: 32 
      Framed-MTU Attribute (12), length: 6, Value: 1400 
        0x0000: 0000 0578 
      NAS-Port-Type Attribute (61), length: 6, Value: Wireless - IEEE 802.11 
        0x0000: 0000 0013 
      Connect-Info Attribute (77), length: 24, Value: CONNECT 11Mbps 802.11b 
        0x0000: 434f 4e4e 4543 5420 3131 4d62 7073 2038 
        0x0010: 3032 2e31 3162 

Continuing with tcpdump, Access-Challenge is issued from FortiAuthenticator to the Switch:

01:09:34.679881 IP (tos Ox0, ttl 64, id 58896, offset 0, flags [none], proto UDP (17), length 108)
  10.1.2.29.1812 > 10.1.2.27.1025: [bad udp cksum 0xl8a3 -> 0xbd921] RADIUS, length: 80 
    Access-Challenge (11), id: 0x9c, Authenticator: c67b8d0f8805db68e57e9757deda20d0
      EAP-Message Attribute (79), length: 24, Value: .. 
        0x0000: 0101 0016 0410 8b8c ae75 4696 0a47 96fd 
        0x0010: 7c26 528a 097e 
      Message-Authenticator Attribute (80), length: 18, Value: ..... 1.!.q._.*[. 
        0x0000: @ad flfd e931 1321 f571 f85f dl2a Sbd3 
      State Attribute (24), length: 18, Value: .!&.. "..9[~.... 
        0x0000: ad21 2611 ad20 22e2 e539 5b7e 94e2 9a87 

The next 14 messages are Challenge->Request EAP transactions between the FortiAuthenticator and the FortiWiFi.

Access-Accept message with RADIUS attributes are returned to the Switch:

2:04:10.000998 IP (tos Ox0, ttl 64, id 44468, offset 0, flags (none), proto UDP (17), length 208) 
  10.1.2.29.1812 > 10.1.2.27.1025: (bad udp cksum 0x1918 0x77e9I) RADIUS, length: 180 
    Access-Accept (2), id: Ox7d, Authenticator: 144538f6ifd7f4b12d768e76f05709ae2 
      Vendor-Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311) 
        Vendor Attribute: 17, Length: 50, Value: ..S.|..W...^.. ..h0p.U..~..{. P..|b7"............s..
        0x0000: 0000 0137 1134 80e3 aefl 65e0 1383 c34e
        0x0010: 413d 4Sbd 350d 39be ac79 04b8 90fa 1551
        0x0020: a4b7 10d3 09b6 f902 5e52 3d69 b3b4 216a
        0x0030: b48f 0ef2 0c08 9cd0
      Vendor-Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311)
        Vendor Attribute: 16, Length: 50, Value: .t._M.,...a...a.JhFz5.....2.;".."...D.y.=..{./..?.
        0x0000: 0000 0137 1034 8883 7a9b bllb 9488 f181
        0x0010: d179 29ba 7538 lleb 8311 3c22 1b62 9176
        0x0020: d0be f763 4617 670c d8ca 8659 7a14 dl2c
        0x0030: 8064 5955 942b ccla 
      EAP-Message Attribute (79), length: 6, Value: .. 
        0x0000: 0307 0004 
      Message-Authenticator Attribute (80), length: 18, Value: .c.b..m.G.ZH.'.6
        0x0000: 9aec 02c0 3e6b af8e defb 8020 e50b 0728 
      User-Name Attribute (1), length: 6, Value: kash
        0x0000: 6b61 7368
      Vendor-Specific Attribute (26), length: 14, Value: Vendor: Fortinet (12356)
        Vendor Attribute: 1, Length: 6, Value: VLAN10
        0x0000: 0000 3044 0108 564c 414e 3130 

On the FortiAuthenticator, go to Logging > Log Access > Logs to verify the device authentication.

The Debug Log (at https://<fac-ip>/debug/radius) should also confirm successful authentication.

On the FortiWifi, go to WiFi & Switch Controller > Monitor > Client Monitor and note that the Group is the RADIUS attribute sent from FortiAuthenticator. Any Firewall policy using that Group will now be enabled for the user.