Security

Hi All,

I have a scenario with Clearpass, Wireless Controller and RAPs in bridge mode on branches. On each branch I have a Fortinet firewall that does the web filter inspection.

We've configured Clearpass to send the Accounting Radius to the Fortinet Firewall successfully. However we are observing an abnormal behavior of Accounting Radius sent and in the  packet capture we have identified that the Clearpass is sending Radius Start and after a few seconds Radius Stop. Making users disconnect from the RSSO rule in Fortinet.

By the capture analysis the cause of Radius STOP was idle user timeout.

In the AAA profile I have not configured the user idle timeout.

Has anyone ever been in this situation?

Thanks,

Ed

Hi 

Can you share me an attribute which is selected and sent to Fortigate on Accouting proxy page 

Thanks!

Hi

You must use the 11-Filter-ID attribute in Clearpass.

By default, Fortigate uses the Class attribute. Then you must change it in the fortigate to accept the 11-Filter-ID attribute.

This document ca guide you how to perform the configuration.

https://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default.aspx?EntryId=18160

Thanks.

Thank you for your reply.

I can't download file from your link 

A critical error has occurred.
Could not find a part of the path 'G:\SupportSite\S3Directory\d4760e86-ded6-453d-8980-d97f45dd550e\CPPM TechNote - 3rd Party Enforcement Points (Fortinet) V1.1.pdf. 

It looks like there is a problem on the aruba support site.

See if you can download from this post.

Attachment(s)

CPPM TechNote - 3rd Party Enforcement Points (Fortinet) V...1   4.78 MB 1 version