Hi Freeradius gurus, I am setting up a freeradius (ver 3.0.16) server on a ubundu 18.04 box and I will use it to authenticate admin access to the networking devices for the mgmt purpose. It doesn't store user passwords locally. It will proxy the authentication requests to a Windows NPS (also running the radius service) that has access to the Windows AD for the user credentials. The idea is that, this freeradius server would append the VSAs for users upon successful authentication to give them the adequate access on the switches, routers, firewalls, ...etc So I am able to proxy the authentication request to the NPS and I am getting Access-accept back. I am able to get the proper access to my firewall by sending the VSAs but only if I use local accounts. However, I just can't combine them together. Here is my authorize file dzhao Proxy-To-Realm := 'pason.com' Fortinet-Group-Name := 'RW' Here is my proxy.conf home_server CorpIT_NPS { type = auth ipaddr = it-00-nps-pro2 port = 1812 secret = xxx response_window = 60 zombie_period = 120 } home_server_pool CorpIT_NPS_pool { type = fail-over home_server = CorpIT_NPS } realm pason.com { auth_pool = CorpIT_NPS_pool } Here is my -X output. The NPS does MFA so the response is a little slow because I need to click on "approve" on the phone app. I don't see the Access-Accept packet to the client has the Fortinet VSA of "RW" included... Ready to process requests (0) Received Access-Request Id 42 from 172.16.0.99:1114 to 10.92.3.75:1812 length 104 (0) NAS-Identifier = "FGT60D4613054197" (0) User-Name = "dzhao" (0) User-Password = "Xxx" (0) NAS-Port-Type = Virtual (0) Acct-Session-Id = "6ddb75a0" (0) Connect-Info = "admin-login" (0) Fortinet-Vdom-Name = "root" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "dzhao", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry dzhao at line 1 (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> dzhao (0) sql: SQL-User-Name set to 'dzhao' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dzhao' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dzhao' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'dzhao' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'dzhao' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.1.44-MariaDB-0ubuntu0.18.04.1, protocol version 10 (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = ok (0) Starting proxy to home server 10.92.3.105 port 1812 (0) Proxying request to home server 10.92.3.105 port 1812 timeout 30.000000 (0) Sent Access-Request Id 10 from 0.0.0.0:53464 to 10.92.3.105:1812 length 138 (0) NAS-Identifier = "FGT60D4613054197" (0) User-Name = "dzhao" (0) User-Password = "Xxx" (0) NAS-Port-Type = Virtual (0) Acct-Session-Id = "6ddb75a0" (0) Connect-Info = "admin-login" (0) Fortinet-Vdom-Name = "root" (0) Event-Timestamp = "Jun 1 2020 12:16:22 MDT" (0) NAS-IP-Address = 172.16.0.99 (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x3432 Waking up in 0.3 seconds. (0) Expecting proxy response no later than 29.667310 seconds from now Waking up in 29.6 seconds. (0) Sending duplicate proxied request to home server 10.92.3.105 port 1812 - ID: 10 (0) Sent Access-Request Id 10 from 0.0.0.0:53464 to 10.92.3.105:1812 length 138 (0) NAS-Identifier = "FGT60D4613054197" (0) User-Name = "dzhao" (0) User-Password = "Xxx" (0) NAS-Port-Type = Virtual (0) Acct-Session-Id = "6ddb75a0" (0) Connect-Info = "admin-login" (0) Fortinet-Vdom-Name = "root" (0) Event-Timestamp = "Jun 1 2020 12:16:22 MDT" (0) NAS-IP-Address = 172.16.0.99 (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x3432 Waking up in 25.0 seconds. (0) Marking home server 10.92.3.105 port 1812 alive (0) Clearing existing &reply: attributes (0) Received Access-Accept Id 10 from 10.92.3.105:1812 to 10.92.3.75:53464 length 82 (0) Proxy-State = 0x3432 (0) Framed-Protocol = PPP (0) Service-Type = Framed-User (0) Class = 0x94be085900000137000102000a5c03690000000031a22bda391cd93d01d635f7b722a976000000000000000d (0) # Executing section post-proxy from file /etc/freeradius/3.0/sites-enabled/default (0) post-proxy { (0) eap: No pre-existing handler found (0) [eap] = noop (0) } # post-proxy = noop (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> dzhao (0) sql: SQL-User-Name set to 'dzhao' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'dzhao', 'Xxx', 'Access-Accept', '2020-06-01 12:16:22') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'dzhao', 'Xxx', 'Access-Accept', '2020-06-01 12:16:22') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) Need 3 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (7), 1 of 25 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.1.44-MariaDB-0ubuntu0.18.04.1, protocol version 10 (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Login OK: [dzhao] (from client FGT60D4613054197 port 0) (0) Sent Access-Accept Id 42 from 10.92.3.75:1812 to 172.16.0.99:1114 length 0 (0) Framed-Protocol = PPP (0) Service-Type = Framed-User (0) Class = 0x94be085900000137000102000a5c03690000000031a22bda391cd93d01d635f7b722a976000000000000000d (0) Finished request Waking up in 4.9 seconds. (0) Waiting for more responses from the home server Waking up in 0.3 seconds. (0) Waiting for more responses from the home server Waking up in 0.4 seconds. (0) Waiting for more responses from the home server Waking up in 0.7 seconds. (0) Waiting for more responses from the home server Waking up in 1.1 seconds. (0) Waiting for more responses from the home server Waking up in 1.6 seconds. (0) Waiting for more responses from the home server Waking up in 2.5 seconds. (0) Waiting for more responses from the home server Waking up in 3.7 seconds. (0) Waiting for more responses from the home server Waking up in 5.6 seconds. (0) Waiting for more responses from the home server Waking up in 8.5 seconds. (0) Cleaning up request packet ID 42 with timestamp +7 Ready to process requests I also tried to play with the ./mods-config/attr_filter/post-proxy file but it doesn't work for me either. Here is my post-proxy config dzhao Fortinet-Group-Name := 'RW' Please help! Thanks, Difan