LogoLogo
LogoLogo
  • Welcome
  • Details
  • Configuration
    • Getting Started
      • Generic Guide
      • Scenario-based Guides
        • Microsoft Cloud PKI
        • SCEPman PKI
    • Access Point Setup
      • RadSec
        • Aruba
        • FortiNet
        • Juniper Mist
        • Meraki
        • MikroTik
        • Ruckus
        • UniFi
      • RADIUS
        • ExtremeCloud IQ CoPilot
        • Meraki
        • Sophos UTM
        • UniFi
    • Server Certificate Renewal
  • Admin Portal
    • Home
    • Insights
      • Rule Engine
      • Logs
    • Users
    • Settings
      • Server Settings
      • Trusted Certificates
      • Proxy Settings
      • Permissions
      • User Settings
      • Rules
        • General Structure
        • WiFi
        • LAN
        • VPN
      • Log Exporter
        • Teams
        • Log Analytics
        • Generic Webhook
        • Examples
    • My Invited Users
  • Profile Deployment
    • Microsoft Intune
      • Server Trust
      • WiFi Profile
        • Windows
        • iOS/iPadOS & macOS
        • Android
      • Wired Profile
        • Windows
        • macOS
    • Jamf Pro
      • Server Trust
      • WiFi Profile
      • Wired Profile
    • Google Workspace
      • Server Trust
      • WiFi Profile
  • Other
    • Troubleshooting
    • FAQs
      • General
      • Log & Common Errors
      • MAC Authentication
      • Blast-RADIUS Vulnerability
      • OCSP Soft-fail Consequences
      • Security & Privacy
    • REST API
      • External Monitoring
    • Changelog
  • Licensing
    • Azure Marketplace
  • Support & Service Level
  • RADIUSaaS Website
Powered by GitBook
On this page
  • Prepare certificates
  • FortiGate configuration
  • Via UI
  • Via command line
  • References

Was this helpful?

  1. Configuration
  2. Access Point Setup
  3. RadSec

FortiNet

Last updated 6 months ago

Was this helpful?

To use the RadSec feature on your FortiGate for WiFi (with FortiAPs), firmware FortiOS 7.6.0 or later is required on the FortiGate.

Prepare certificates

To establish a valid RadSec connection, your Access Points must trust the RADIUS Server Certificate and your RADIUS server must trust your RadSec Client Certificate. To achieve this,

  1. Download the root certificate of the CA that has issued your active RADIUS Server Certificate as described .

  2. Create a RadSec Client Certificate for your WAPs (centrally managed via FortiGate). If you are using SCEPman Certificate Master, the process is described . FortiGate accepts the PKCS#12 format for RadSec client certificates.

Ensure to monitor the expiry of your RadSec Client Certificate and renew it in due time to prevent service interruptions.

  1. Add the root certificate of the CA that has issued the RadSec Client Certificate to your RADIUS instance as described and select RadSec under Use for. In case the RadSec Client Certificate has been issued by SCEPman and you already trust the SCEPman Root CA for client authentication, simply edit the trusted SCEPman Root CA certificate and select Both under Use for.

FortiGate configuration

Below settings are the necessary settings to establish a functional RadSec connection with our service. Configure any other settings at your discretion.

Via UI

To configure RadSec on your FortiGate UI please follow the steps:

  • Create a new RADIUS Server and add your under IP/Name. For the Secret, use "radsec".

  • Import the RadSec Client Certificate to your FortiGate under System > Certificates > Import > Certificate.

  • Modify the RADIUS server configuration in your FortiGate to use it as RadSec client certificate.

  • If enabled, please disable the server-identity-check in your FortiGate RADIUS server configuration.

Via command line

To configure RadSec on your FortiGate using the command line, please use these below sets of instructions:

RADIUS server configuration

config user radius

    edit "radiusaas"

        set server "radsec-CLIENTNAME.radius-as-a-service.com"

        set secret radsec

        set acct-interim-interval 600

        set radius-port 2083

        set transport-protocol tls

        set ca-cert "CA_Cert"

        set client-cert "certificate-fortigate"

        set server-identity-check disable

    next

end

# Name the root CA of your RADIUS Server Certificate
set ca-cert "CA_Cert"

# Name the RadSec client certificate
set client-cert "certificate-fortigate"

WiFi SSID configuration

config wireless-controller vap

    edit "client-wireless"

        set ssid "client-wireless"

        set security wpa2-only-enterprise

        set pmf enable

        set 80211k disable

        set 80211v disable

        set auth radius

        set radius-server "radiusaas"

        set local-bridging enable

        set schedule "always"

    next

end

References

Import the to the FortiGate Certificates under System > Certificates > Import > CA Certificate. The imported root CA will be listed under Remote CA Certificate.

Link to FortiGate's documentation for the RadSec configuration:

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/729374/configuring-a-radsec-client
here
here
root CA of your RADIUS Server Certificate
here
RadSec server IP address