Security

Hello,

we authenticate our fortigate against clearpass, after upgrade to v7.2.10 we receive an invalid secret for server (clearpass)

i found a solution in the fortigate community however this is limited to window server, linux free radius, cisco ise & cisco duo.

I would like to know how to send the send message-authenticator attribute to solve this issue

>https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-failure-after-the/ta-p/343112

Would be good to understand what version you are running today.

In any case, ClearPass already sends by default the Message-Authenticator attribute as the first attribute in the packet. That doesn't require any configuration. Not sure if you are looking at the same issue here that is discussed in the Fortinet community.

I recommend taking a Packet Capture on ClearPass to see the actual packets being exchanged.

Recent ClearPass patches have only introduced an additional configurable service parameter enforcing the presence of the attribute in the request sent by the NAD: https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.x.x/Default.htm#ReleaseNotes/Behaviors/Behaviors-6.11.9.htm

When enabled, this will result in ClearPass dropping any request that does not include the M-A in the first attribute for either a request or a Dynamic Authorization.

Hello,

we authenticate our fortigate against clearpass, after upgrade to v7.2.10 we receive an invalid secret for server (clearpass)

i found a solution in the fortigate community however this is limited to window server, linux free radius, cisco ise & cisco duo.

I would like to know how to send the send message-authenticator attribute to solve this issue

>https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-failure-after-the/ta-p/343112

Clearpass version: ClearPass Policy Manager 6.11.7.257550 

it is already clear what the solution for the problem with the authentication is (send the message-authenticator attribute), however i don't know how to implement this solution in clearpass.

In the added link in the initial problem description it is explained.

Would be good to understand what version you are running today.

In any case, ClearPass already sends by default the Message-Authenticator attribute as the first attribute in the packet. That doesn't require any configuration. Not sure if you are looking at the same issue here that is discussed in the Fortinet community.

I recommend taking a Packet Capture on ClearPass to see the actual packets being exchanged.

Recent ClearPass patches have only introduced an additional configurable service parameter enforcing the presence of the attribute in the request sent by the NAD: https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.x.x/Default.htm#ReleaseNotes/Behaviors/Behaviors-6.11.9.htm

When enabled, this will result in ClearPass dropping any request that does not include the M-A in the first attribute for either a request or a Dynamic Authorization.

Hello,

we authenticate our fortigate against clearpass, after upgrade to v7.2.10 we receive an invalid secret for server (clearpass)

i found a solution in the fortigate community however this is limited to window server, linux free radius, cisco ise & cisco duo.

I would like to know how to send the send message-authenticator attribute to solve this issue

>https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-failure-after-the/ta-p/343112

As mentioned, ClearPass always sends the M-A attribute by default. No extra configuration required. 

If you want to confirm that this is happening in your environment, take a PCAP from your ClearPass server when sending a request: https://www.arubanetworks.com/techdocs/ClearPass/6.11/PolicyManager/Content/CPPM_UserGuide/Admin/ServerConfig_collectlogs.htm

The only capability added in the patch I called out, is to give the admin a choice to enforce this attribute on requests sent by the NAD.

Clearpass version: ClearPass Policy Manager 6.11.7.257550 

it is already clear what the solution for the problem with the authentication is (send the message-authenticator attribute), however i don't know how to implement this solution in clearpass.

In the added link in the initial problem description it is explained.

Would be good to understand what version you are running today.

In any case, ClearPass already sends by default the Message-Authenticator attribute as the first attribute in the packet. That doesn't require any configuration. Not sure if you are looking at the same issue here that is discussed in the Fortinet community.

I recommend taking a Packet Capture on ClearPass to see the actual packets being exchanged.

Recent ClearPass patches have only introduced an additional configurable service parameter enforcing the presence of the attribute in the request sent by the NAD: https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.x.x/Default.htm#ReleaseNotes/Behaviors/Behaviors-6.11.9.htm

When enabled, this will result in ClearPass dropping any request that does not include the M-A in the first attribute for either a request or a Dynamic Authorization.

Hello,

we authenticate our fortigate against clearpass, after upgrade to v7.2.10 we receive an invalid secret for server (clearpass)

i found a solution in the fortigate community however this is limited to window server, linux free radius, cisco ise & cisco duo.

I would like to know how to send the send message-authenticator attribute to solve this issue

>https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-failure-after-the/ta-p/343112

Slight clarification:  if the Message-Authenticator AVP is present in the Access-Request, ClearPass responses will always include the AVP as well.  The toggle changes the behavior to ClearPass dropping any request that doesn't include the AVP.

As for this specific case, have you tested using the CLI?

As mentioned, ClearPass always sends the M-A attribute by default. No extra configuration required. 

If you want to confirm that this is happening in your environment, take a PCAP from your ClearPass server when sending a request: https://www.arubanetworks.com/techdocs/ClearPass/6.11/PolicyManager/Content/CPPM_UserGuide/Admin/ServerConfig_collectlogs.htm

The only capability added in the patch I called out, is to give the admin a choice to enforce this attribute on requests sent by the NAD.

Clearpass version: ClearPass Policy Manager 6.11.7.257550 

it is already clear what the solution for the problem with the authentication is (send the message-authenticator attribute), however i don't know how to implement this solution in clearpass.

In the added link in the initial problem description it is explained.

Would be good to understand what version you are running today.

In any case, ClearPass already sends by default the Message-Authenticator attribute as the first attribute in the packet. That doesn't require any configuration. Not sure if you are looking at the same issue here that is discussed in the Fortinet community.

I recommend taking a Packet Capture on ClearPass to see the actual packets being exchanged.

Recent ClearPass patches have only introduced an additional configurable service parameter enforcing the presence of the attribute in the request sent by the NAD: https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.x.x/Default.htm#ReleaseNotes/Behaviors/Behaviors-6.11.9.htm

When enabled, this will result in ClearPass dropping any request that does not include the M-A in the first attribute for either a request or a Dynamic Authorization.

Hello,

we authenticate our fortigate against clearpass, after upgrade to v7.2.10 we receive an invalid secret for server (clearpass)

i found a solution in the fortigate community however this is limited to window server, linux free radius, cisco ise & cisco duo.

I would like to know how to send the send message-authenticator attribute to solve this issue

>https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-failure-after-the/ta-p/343112

Fortigate  v7.2.10  is not including Message-Authenticator AVP, there is no option to include this.

Clearpass include the messeage by default.

i asume one option is left, downgrade the fortinet an open a ticket at fortinet support..

Any other ideas?

Slight clarification:  if the Message-Authenticator AVP is present in the Access-Request, ClearPass responses will always include the AVP as well.  The toggle changes the behavior to ClearPass dropping any request that doesn't include the AVP.

As for this specific case, have you tested using the CLI?

As mentioned, ClearPass always sends the M-A attribute by default. No extra configuration required. 

If you want to confirm that this is happening in your environment, take a PCAP from your ClearPass server when sending a request: https://www.arubanetworks.com/techdocs/ClearPass/6.11/PolicyManager/Content/CPPM_UserGuide/Admin/ServerConfig_collectlogs.htm

The only capability added in the patch I called out, is to give the admin a choice to enforce this attribute on requests sent by the NAD.

Clearpass version: ClearPass Policy Manager 6.11.7.257550 

it is already clear what the solution for the problem with the authentication is (send the message-authenticator attribute), however i don't know how to implement this solution in clearpass.

In the added link in the initial problem description it is explained.

Would be good to understand what version you are running today.

In any case, ClearPass already sends by default the Message-Authenticator attribute as the first attribute in the packet. That doesn't require any configuration. Not sure if you are looking at the same issue here that is discussed in the Fortinet community.

I recommend taking a Packet Capture on ClearPass to see the actual packets being exchanged.

Recent ClearPass patches have only introduced an additional configurable service parameter enforcing the presence of the attribute in the request sent by the NAD: https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.x.x/Default.htm#ReleaseNotes/Behaviors/Behaviors-6.11.9.htm

When enabled, this will result in ClearPass dropping any request that does not include the M-A in the first attribute for either a request or a Dynamic Authorization.

Hello,

we authenticate our fortigate against clearpass, after upgrade to v7.2.10 we receive an invalid secret for server (clearpass)

i found a solution in the fortigate community however this is limited to window server, linux free radius, cisco ise & cisco duo.

I would like to know how to send the send message-authenticator attribute to solve this issue

>https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-failure-after-the/ta-p/343112

Fortigate  v7.2.10  is not including Message-Authenticator AVP, there is no option to include this.

Clearpass include the messeage by default.

i asume one option is left, downgrade the fortinet an open a ticket at fortinet support..

Any other ideas?

Slight clarification:  if the Message-Authenticator AVP is present in the Access-Request, ClearPass responses will always include the AVP as well.  The toggle changes the behavior to ClearPass dropping any request that doesn't include the AVP.

As for this specific case, have you tested using the CLI?

As mentioned, ClearPass always sends the M-A attribute by default. No extra configuration required. 

If you want to confirm that this is happening in your environment, take a PCAP from your ClearPass server when sending a request: https://www.arubanetworks.com/techdocs/ClearPass/6.11/PolicyManager/Content/CPPM_UserGuide/Admin/ServerConfig_collectlogs.htm

The only capability added in the patch I called out, is to give the admin a choice to enforce this attribute on requests sent by the NAD.

Clearpass version: ClearPass Policy Manager 6.11.7.257550 

it is already clear what the solution for the problem with the authentication is (send the message-authenticator attribute), however i don't know how to implement this solution in clearpass.

In the added link in the initial problem description it is explained.

Would be good to understand what version you are running today.

In any case, ClearPass already sends by default the Message-Authenticator attribute as the first attribute in the packet. That doesn't require any configuration. Not sure if you are looking at the same issue here that is discussed in the Fortinet community.

I recommend taking a Packet Capture on ClearPass to see the actual packets being exchanged.

Recent ClearPass patches have only introduced an additional configurable service parameter enforcing the presence of the attribute in the request sent by the NAD: https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.x.x/Default.htm#ReleaseNotes/Behaviors/Behaviors-6.11.9.htm

When enabled, this will result in ClearPass dropping any request that does not include the M-A in the first attribute for either a request or a Dynamic Authorization.

Hello,

we authenticate our fortigate against clearpass, after upgrade to v7.2.10 we receive an invalid secret for server (clearpass)

i found a solution in the fortigate community however this is limited to window server, linux free radius, cisco ise & cisco duo.

I would like to know how to send the send message-authenticator attribute to solve this issue

>https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-failure-after-the/ta-p/343112