On Feb 16, 2021, at 8:38 AM, Michael Fischer <michael@webfischer.at> wrote:
My goal is to authenticate WiFi-Users via FreeRadius with an eDirectory backend. FreeRadius should then send an accounting packet to a FortiGate firewall where a SSO agent is running.
The server doesn't really originate accounting packets.
The authentication part is working find, a user can connect to the WiFi.
As far as I understood it, I should configure FreeRadius to write a detail file which is then parsed an an accounting package sent to the Fortigate firewall.
Well... maybe. But you can't write an Access-Accept packet, and have it magically turn into an Accounting-Request packet.
Reading the detail file seems to work fine, but no accounting package is sent to the FortiGate firewall (I even checked using Wireshark). See a part of the debug-log here: ... detail (/var/log/radius/radacct/detail-*): Read packet from /var/log/radius/radacct/detail.work Packet-Type = Access-Accept
That's not an Accounting packet, is it? Further, that packet doesn't contain any normal accounting attributes.
Class = 0x54657374 User-Name = "fimi" MS-MPPE-Recv-Key = 0x28765691676b5035b99c8aa3b2b5bb8c1e9b4b3e32a457239e11df0cdac127ea MS-MPPE-Send-Key = 0x1120b9224c29ff96b3ed507b19eabd80bb1c7728772cbe8305a876cede81c224 EAP-MSK = 0x28765691676b5035b99c8aa3b2b5bb8c1e9b4b3e32a457239e11df0cdac127ea1120b 9224c29ff96b3ed507b19eabd80bb1c7728772cbe8305a876cede81c224 EAP-EMSK = 0xd3a64e1f290603568302a9f6c13c3ae00eaea0f45caeff1503b5609e2faf9b06be114 12f1243564b0a08b8df5d58cc33235989699b860f0171b9b73a29bb0e36
You really don't want to send EAP-MSK and EAP-EMSK over the wire to another system. TBH, just run "radclient" for now. Or, use the Perl / Python modules to send RADIUS packets. The server isn't really designed to change packet types like this. We've fixed all of this in v4, where this goal is pretty much trivial to do. But we're still a long way from releasing v4. Alan DeKok.