Fortigate 7.4.6 Compatibility with Solution for Fortigate 7.4.3: Configuration or Patches Needed?

[ramiabdallah1512]

My firewall is running Fortigate 7.4.6, while the solution is compatible with Fortigate 7.4.3. Is there a solution or additional configuration to add, or any patches to apply? Thank you

[abbas-gheydi]

My firewall is running Fortigate 7.4.6, while the solution is compatible with Fortigate 7.4.3. Is there a solution or additional configuration to add, or any patches to apply? Thank you

Dear @ramiabdallah1512 ,

Thank you for commenting and reaching out. I plan to add RadSec support to RadOTP in the next release. but for now you can search for and use a RadSec proxy to fix the FortiGate issue.

[Ctere1]

Hi @abbas-gheydi, @ramiabdallah1512

Regarding your statement about Fortigate compatibility, when you refer to Fortigate compatible, are you referring to the Message-Authenticator attribute?

I’ve already added the necessary attribute in the project and ensured all the dependencies are updated accordingly. I wanted to share the updates with you here for your consideration.

Here’s the code I have updated:

func AcceptUser(w radius.ResponseWriter, r *radius.Request, stage string) (code radius.Code) {
	code = radius.CodeAccessAccept
	packet := r.Packet.Response(code)

	// Add Message-Authenticator placeholder to the response packet at the first place
	placeholder := make([]byte, 16) // 16 bytes of zeros
	rfc2869.MessageAuthenticator_Set(packet, placeholder)

	if state := rfc2865.State_GetString(r.Packet); state != "" {
		rfc2865.State_SetString(packet, state)
	}
	AddVendorGroup(packet, r)

	// DO NOT Add another attribute after Message-Authenticator, it may cause the Message-Authenticator to be invalid
	AddMessageAuthenticator(packet)

	w.Write(packet)
	go sendToMonitoring(rfc2865.UserName_GetString(r.Packet), stage, "Accept")

	return
}



// Other code goes here...
// The ChallengeUser and RejectUser methods should also be updated in the same way



// AddMessageAuthenticator adds the Message-Authenticator attribute to a RADIUS packet.
// Message-Authenticator = HMAC-MD5 (Type, Identifier, Length, Request Authenticator, Attributes)
func AddMessageAuthenticator(packet *radius.Packet) error {
	// Step 1: Set the Message-Authenticator field to zero.
	placeholder := make([]byte, 16) // 16 bytes of zeros
	err := rfc2869.MessageAuthenticator_Set(packet, placeholder)
	if err != nil {
		return err
	}

	// Step 2: Marshal the packet to get the binary representation
	b, err := packet.MarshalBinary()
	if err != nil {
		return err
	}

	// Step 3: Calculate HMAC-MD5 with the shared secret
	mac := hmac.New(md5.New, []byte(RadiusConfigs.Secret))
	mac.Write(b)

	// Step 4: Get the authenticator (HMAC result)
	authenticator := mac.Sum(nil)

	// Step 5: Set the Message-Authenticator field
	err = rfc2869.MessageAuthenticator_Set(packet, authenticator)
	if err != nil {
		return err
	}

	return nil
}

I hope this helps! Maybe I can fork the project and open a PR. Let me know if I can help further.

Thank you for your work on this project.

[abbas-gheydi]

Hi @abbas-gheydi, @ramiabdallah1512

Regarding your statement about Fortigate compatibility, when you refer to Fortigate compatible, are you referring to the Message-Authenticator attribute?

I’ve already added the necessary attribute in the project and ensured all the dependencies are updated accordingly. I wanted to share the updates with you here for your consideration.

Here’s the code I have updated:

func AcceptUser(w radius.ResponseWriter, r *radius.Request, stage string) (code radius.Code) {
code = radius.CodeAccessAccept
packet := r.Packet.Response(code)

// Add Message-Authenticator placeholder to the response packet at the first place
placeholder := make([]byte, 16) // 16 bytes of zeros
rfc2869.MessageAuthenticator_Set(packet, placeholder)

if state := rfc2865.State_GetString(r.Packet); state != "" {
rfc2865.State_SetString(packet, state)
}
AddVendorGroup(packet, r)

// DO NOT Add another attribute after Message-Authenticator, it may cause the Message-Authenticator to be invalid
AddMessageAuthenticator(packet)

w.Write(packet)
go sendToMonitoring(rfc2865.UserName_GetString(r.Packet), stage, "Accept")

return
}

// Other code goes here...
// The ChallengeUser and RejectUser methods should also be updated in the same way

// AddMessageAuthenticator adds the Message-Authenticator attribute to a RADIUS packet.
// Message-Authenticator = HMAC-MD5 (Type, Identifier, Length, Request Authenticator, Attributes)
func AddMessageAuthenticator(packet *radius.Packet) error {
// Step 1: Set the Message-Authenticator field to zero.
placeholder := make([]byte, 16) // 16 bytes of zeros
err := rfc2869.MessageAuthenticator_Set(packet, placeholder)
if err != nil {
return err
}

// Step 2: Marshal the packet to get the binary representation
b, err := packet.MarshalBinary()
if err != nil {
return err
}

// Step 3: Calculate HMAC-MD5 with the shared secret
mac := hmac.New(md5.New, []byte(RadiusConfigs.Secret))
mac.Write(b)

// Step 4: Get the authenticator (HMAC result)
authenticator := mac.Sum(nil)

// Step 5: Set the Message-Authenticator field
err = rfc2869.MessageAuthenticator_Set(packet, authenticator)
if err != nil {
return err
}

return nil
}
I hope this helps! Maybe I can fork the project and open a PR. Let me know if I can help further.

Thank you for your work on this project.

Dear @Ctere1 , thank you very much for your attention and the time you spent. Please send the PR so we can merge it and other users can benefit from these changes. Thank you.

[Ctere1]

I have just created the PR. Please take a look, and once everything looks good, we can proceed with merging it. Thanks again!

I would like to point out that I renamed the following tables for consistency with the project naming conventions:

• otps → radotp_otps
• webadmin → radotp_webadmin

[Ctere1]

@abbas-gheydi

Additionally, as per the draft-ietf-radext-deprecating-radius, security tracking for RADIUS can be performed by ensuring the proper handling of the Message-Authenticator attribute. This is particularly important in the context of Section 5.3.6. Server Responses to Access-Request, where the correct validation of this attribute is crucial for ensuring secure communication.

Currently, the server does not validate the Message-Authenticator in the incoming packets, which may expose security vulnerabilities. In this PR, I have added the Message-Authenticator attribute to the RADIUS package as the first step to address this issue.

It is important to note that while this PR addresses the Fortigate connection issue by adding the Message-Authenticator attribute, further security measures should still be considered to ensure comprehensive protection.

[abbas-gheydi]

Dear @ramiabdallah1512 ,

The issue you mentioned has been resolved in version 2.4.0, which has been released.
To enable this new feature, you can set EnableMessageAuthenticator to true in the radiusd.conf file.

A special thanks to @Ctere1 for help in fixing this issue!

Thank you,

[ramiabdallah1512]

Hello Team, @abbas-gheydi @Ctere1

I would like to extend my heartfelt thanks for your prompt assistance and dedicated efforts. I have just tested the new solution, and I can confirm that it is fully functional with this version.

Thank you so much for your support!

Best regards,

[Profaustine]

Is there a step by step guide to deploy this as a newbie?

[iamshekoni]

Hello @abbas-gheydi @Ctere1

Thank you for your assistance so far. just installed the 2.4.0 on my test environment successfully but connecting to FortiGate v7.4.7 is giving me "Invalid secret for the server" after inputting correct secret and EnableMessageAuthenticator = true
Please advice on what other change that needs to be made.

Thanks in advance

[iamshekoni]

Hello Team, @abbas-gheydi @Ctere1

I would like to extend my heartfelt thanks for your prompt assistance and dedicated efforts. I have just tested the new solution, and I can confirm that it is fully functional with this version.

Thank you so much for your support!

Best regards,

what did you do to make it work. i will appreciate your response

[iamshekoni]

Dear @ramiabdallah1512 ,

The issue you mentioned has been resolved in version 2.4.0, which has been released. To enable this new feature, you can set EnableMessageAuthenticator to true in the radiusd.conf file.

A special thanks to @Ctere1 for help in fixing this issue!

Thank you,

@abbas-gheydi @Ctere1
Hi, I have downgraded to Fortigate 7.4.6 am still experiencing the same issue "Invalid secret for the server" i have also change the EnableMessageAuthenticator = true in the radiusd.conf file

[Ctere1]

@iamshekoni,
Please make sure to specify the authentication method as PAP on the FortiGate . This error can sometimes occur if the authentication method is not properly aligned. Also, ensure that the shared secret configured on both devices matches exactly.

Additionally, try deleting the existing RADIUS user and create a new one from scratch, making sure to re-enter the Secret key carefully.

If the issue persists, check the FortiGate CLI and enable debug logs to get more detailed output for troubleshooting. Fortinet documentation

[iamshekoni]

@iamshekoni, Please make sure to specify the authentication method as PAP on the FortiGate . This error can sometimes occur if the authentication method is not properly aligned. Also, ensure that the shared secret configured on both devices matches exactly.

Additionally, try deleting the existing RADIUS user and create a new one from scratch, making sure to re-enter the Secret key carefully.

If the issue persists, check the FortiGate CLI and enable debug logs to get more detailed output for troubleshooting. Fortinet documentation

@Ctere1
Thank you for the response. Changed it to PAP as advised and ensured the secret is same on both sides, I have also recreated too, Blow is the image

[Ctere1]

You might also want to try replacing 0.0.0.0 with the actual IP address of the RADIUS server in the listen configuration.

While 0.0.0.0 allows the server to listen on all interfaces, explicitly binding to the server’s real IP can improve stability—especially if FortiGate is configured to connect to a specific IP. This helps avoid any ambiguity and ensures the RADIUS service is reachable on the correct interface.

[abbas-gheydi]

Also, I recommend restarting the radotp container after applying configuration changes to ensure they take effect