KNS | ˈkɛvɪn netsec

Musings about networks and security

Tag: inspection

  • FortiClient EMS certificate management for VPN, full SSL/TLS inspection, and 802.1X

    Certificates are ubiquitous in our daily life, whether we realize it or not, and most people fall into one of two camps when it comes to them:

    1. They love them because they make authentication and trust easy
    2. They hate them because they can seem like black magic to some and create unnecessary work due to having to provision and replace them.

    Both sides have valid points, but we can all agree that we need them, be it for securing web traffic, enabling strong authentication or to get rid of those pesky certificate warnings on our GUIs.

    FortiClient EMS has a few options to interact with certificates, so, dear reader, let’s have a look to see how EMS can help us with managing certificates.

    The setup

    • FortiGate 70G on 7.6.7
    • FortiClient EMS on 7.4.7
    • FortiAuthenticator on 8.0.3
    • Windows 11 client on 25H2 with FortiClient 7.4.6
    • FortiAP on 7.6.5
    • FortiSwitch 424E on 7.6.6

    Relevant configuration snippets can be found in the Fortinet resources GitHub repository.

    What am I even doing here?

    FortiClient EMS does two things out of the box when it comes to certificates:

    1. It acts as a certificate authority (CA), using a self-signed ZTNA CA to…
    2. Provision managed FortiClients with a user certificate for ZTNA purposes

    These two things open up quite a few possibilities because the user certificates aren’t anything special. They are regular certificates for client authentication, and since EMS is already distributing the certificates, we might as well put them to good use.

    We could download the default ZTNA public CA certificate and use that in our infrastructure to authenticate users, but this has some caveats, like:

    • It’s a self-signed CA that has no connection to anything, which can be seen as a problem by some people
    • We cannot issue certificates for other services, like webservers, using this CA, because the private key lies with EMS, and EMS only gives certificates to managed FortiClients
    • Corollary, this cannot scale because I only have this one CA, and I can’t create sub/intermediate CAs

    To solve this, I can create a real public key infrastructure (PKI) with a root CA, several sub CAs, including an EMS CA, hand out certificates for all purposes, and I got a nice chain of trust, and that is what I want to show in this post.

    Note: None of the use cases I cover in this post requires running your own PKI. You can do everything in some form using the default certificates and CAs you get with FortiClient EMS and a FortiGate, and without a root CA. I am doing this more to show that you can take it further.

    With the preamble out of the way, let’s begin with the foundation.

    The certificate structure

    To get started, I will be using FortiAuthenticator as a root CA to create two sub CAs:

    1. The EMS_SUBCA, which replaces the default EMS ZTNA CA and signs the certificates for managed FortiClients
    2. The FGT_SUBCA, which will be used by the FortiGate for SSL/TLS inspection

    Very important: I will use EMS_SUBCA in this post to refer to the sub CA that EMS uses, but the CN for this CA must be the serial number of your EMS server. This is a requirement for everything to function correctly.

    Additionally, I create one certificate with the server authentication extended key usage (EKU), so the FortiGate can later authenticate VPN users.

    Post PKI

    Note: I want to mention that the PKI topology I use for this post is not best practice. In a production environment, you should always start with a root CA that gets taken offline after issuing a sub CA, and that sub CA then issues all other certificates. To make it a bit easier on myself, I am only using an online root CA.

    Two-tier PKI

    How do we get to our certificates?

    FortiAuthenticator certificate management

    With FortiAuthenticator, we can do basically everything, so if we just head to Certificate Management -> Certificate Authorities -> Local CAs, we can create the root CA using the provided Root CA type, and after providing an ID and a CN, we got the first part done. You can, of course, change the settings for the CA as you wish.

    FortiAuthenticator root CA

    With the root CA in hand, we can create the EMS and FortiGate sub CAs from the same menu using the Intermediate CA type. Again, it’s very important that the Common Name is the serial number of your EMS server. I only show the EMS sub CA here.

    FortiAuthenticator EMS sub CA CSR

    After creating, make sure to export the key and cert for the two CAs and keep them safe for now. Also, download the public keys using the Export Certificate button from all three CAs.

    We need a certificate for the FortiGate later, and I will do that using the Simple Certificate Enrollment Protocol (SCEP) on FortiAuthenticator. Don’t forget to enable this service on the interface on which the FortiGate contacts FortiAuthenticator. If you use HTTPS, make sure that FortiAuthenticator’s certificate is trusted by the FortiGate.

    FortiAuthenticator SCEP interface

    Then head over to the SCEP Enrollment Requests menu and create a regular request for the FortiGate, signed by the root CA, with a fitting CN, and make sure that the Extended Key Usage of Server Authentication is present. All settings can, of course, be changed as you wish; I am just presenting a basic configuration.

    FortiAuthenticator SCEP enrollment request

    Note the password after creating the request, because we need it right now, because we get to…

    FortiGate certificate management

    Be sure to enable Certificates in Feature Visibility first.

    On the FortiGate, first import the FortiAuthenticator root CA and EMS sub CA certificates. You can do this either using SCEP or via a file upload.

    Then create a certificate signing request (CSR), making sure that the name and domain name match the CN you presented in the SCEP enrollment request (fgt-vpncert for me) and that Online SCEP is used as the Enrollment Method. The CA Server URL is in the format of http://FORTIAUTHENTICATOR-IP-FQDN/app/cert/scep, with HTTPS if you want, and your own IP or FQDN, of course.

    The Challenge Password is the one you got earlier.

    FortiGate VPN certificate CSR

    After a few seconds, the status of the CSR should get signed by FortiAuthenticator and return a Valid status.

    FortiGate VPN certificate

    While you’re here, also import the sub CA certificate for the FortiGate. Remember that this is considered a Certificate, not a CA certificate, when you click on the Create/Import button.

    That’s it for now, so let’s turn to EMS.

    EMS certificate management

    On EMS, we have to do two things:

    1. Change the ZTNA CA certificate to our created one
    2. Make sure clients get the FortiGate’s sub CA certificate

    Point one is done by going to System Settings -> EMS Settings and clicking on the cog icon next to EMS CA Certificate (ZTNA) and uploading the new CA certificate. EMS will automatically hand out certificates to managed FortiClients using this certificate.

    EMS ZTNA CA import

    For point two, we first need to upload the CA certificate under Endpoint Policy & Components -> CA Certificates.

    EMS CA import

    With the uploaded certificate, go to your System Settings profile of choice, make sure that under Other, the Install CA Certificate on Client setting is enabled and pick the CA certificates you want to push to managed FortiClients. Note that the certificate used as the EMS ZTNA CA gets installed without having to do anything.

    EMS CA System Settings

    After these two steps and waiting for a sync, we can see that a connected client now has a user certificate from the new EMS sub CA and trusts the CA certificates that are in the System Settings profile.

    Client user certificate
    Client trusted root CAs

    Note: If you have an on-net endpoint, make sure that whatever you configure in the ZTNA profile does not interfere with normal operations. Imagine that you have a ZTNA destination that uses the FQDN of an internal server. Due to the way ZTNA works, FortiClient will intercept the DNS request, return a bogus IP, and try to ZTNA this connection, which probably means the connection will fail. You probably want to have a disabled ZTNA profile attached to the endpoint’s policy when it is on-net.

    With all our certificates in order, we can actually use them, and why not begin with VPN?

    For VPN

    Note: Since EMS is provisioning user certificates, the certificate can only be used for regular VPN authentication with a logged-in user and pre-logon/start before logon (SBL) is not possible, since only machine certificates can be used in a pre-logon state.

    Starting with the FortiGate, we first need a PKI user that represents the EMS sub CA, so create this PKI user.

    FortiGate PKI user
    config user peer
    edit "EMS-SUBCA"
        set ca "EMS_SUBCA"
    next
end

    The VPN configuration is relatively simple; just make sure that the previously created server authentication certificate is used and only accept client certificates from the EMS sub CA. All other settings, like IP assignment, encryption, DH, etc., are up to you.

    Don’t forget to create a policy using the VPN interface; otherwise, clients can’t connect.

    FortiGate certificate authentication VPN

    config vpn ipsec phase1-interface
    edit "CERT-VPN"
        set type dynamic
        set interface "port1"
        set ike-version 2
        set keylife 28800
        set authmethod signature
        set net-device disable
        set mode-cfg enable
        set ipv4-dns-server1 192.168.1.240
        set proposal aes256gcm-prfsha512
        set dhgrp 21
        set client-resume enable
        set client-resume-interval 300
        set transport auto
        set certificate "fgt-vpncert"
        set peer "EMS-SUBCA"
        set ipv4-start-ip 172.16.100.1
        set ipv4-end-ip 172.16.100.20
        set ipv4-split-include "BASE-RFC1918-192"
    next
end
config vpn ipsec phase2-interface
    edit "CERT-VPN"
        set phase1name "CERT-VPN"
        set proposal aes256-sha256
        set dhgrp 21
        set keepalive enable
        set keylifeseconds 3600
    next
end
config firewall policy
    edit 0
        set name "CERT-VPN"
        set srcintf "CERT-VPN"
        set dstintf "LAN"
        set action accept
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
    next
end

    On EMS, we need a matching VPN configuration in the Remote Access profile. There are a few things to note:

    • Authentication Method is System Store Certificate
    • Disable EAP
    • Configure certificate matching

    Certificate matching is something, I think, not a lot of people are aware of, so here is a technical tip on the topic: Technical Tip: Filter client certificates in FortiClient

    The basic idea is that the certificate for the VPN connection is filtered, so only a specific one appears, which makes the user experience better because you don’t have to worry about which certificate gets used by a user. In my configuration, I am doing a regex match on the common name and a simple match on the issuer, which is enough to get what I need.

    <forticlient_configuration>
    <vpn>
        <ipsecvpn>
            <connections>
                <connection>
                    <ike_settings>
                        <auth_data>
                            <certificate>
                                <common_name>
                                    <match_type>regex</match_type>
                                    <pattern>.*</pattern>
                                </common_name>
                                <issuer>
                                    <match_type>simple</match_type>
                                    <pattern>EMS_SUBCA</pattern>
                                </issuer>
                                <issuer/>
                                <oids/>
                            </certificate>
                        </auth_data>
                    </ike_settings>
                </connection>
            </connections>
        </ipsecvpn>
    </vpn>
</forticlient_configuration>

    The FortiClient XML reference has some more information on how to match and what options are available.

    I am configuring the session resumption feature for this tunnel, by the way.

    Both the FortiGate VPN configuration and the Remote Access XML profile EMS are in the GitHub repository linked above.

    A bit of advice when you first set this up: Create a personal VPN on a FortiClient, recreate the necessary VPN settings, and make sure that works first, just so you know that certificate authentication works. Once that is done, test the VPN configuration you get from EMS. Especially with the certificate filtering, it’s easier to do this bit by bit and not start with the EMS-provided VPN tunnel.

    With the FortiGate and EMS having the correct VPN configuration, we can test the connection, and it should work. We can see that the CN matches the FortiClient ID we see on EMS.

    FortiGate VPN success
    EMS endpoint information

    If we look at the debugs of ike and fnbamd, we can see the entire process (some parts of the debugs are removed):

    FortiGate VPN debugs

    diagnose debug application ike -1
diagnose debug application fnbamd -1
diagnose debug enable

ike V=root:0: comes 192.168.100.2:51056->192.168.100.1:4500,ifindex=5,vrf=0,len=486....
ike V=root:0: IKEv2 exchange=SA_INIT id=5a88db4c560f15da/0000000000000000 len=482
ike 0: in 5A88DB4C560F15DA00000000000000002120220800000000000001E22200006C02000024010100030300000C01000014800E0100030000080400001500000008020000070000004402010007030000080300000C0300000C0100000C800E0100030000080400001503000008020000050300000802000006030000080200000700000008020000022800008C0015000000C99A8B88C2DDEE9963B6D3B52C40B57927668DC1C786D1981C35B1AD5638F56CC380D5280C6905FCF86C1FCBA01C8677249BA6C19290C86DAD24694C3B63F61D750102AB27393AB8D9D29E48D099E36A6BEF6BB06895B64DA96A2E67AF9D8481DCED49F36FA2C2B1FA09C117751D029699749DD359090740383B7EFFE6BCCFA47BE19A2B00002441A822057CFB67B96D2DBA82EE1C490EEA106F34B30490242EE4229FBABB92122B00001C4C53427B6D465D1B337BB755A37A7FEF706B9EBAF67F00002B00001CB4F01CA951E9DA8D0BAFBBD34AD3044E906B9EBAF67F00002900001CC1DC4350476B98A429B91781914CA43E202A8801FD010000290000080000F118290000080000402E2900001C0000400468F9B3E80FB82683054FF61FC4BFF1639CBAD7672900001C0000400540DAB0491BAC2CEB4C65D6506300387954912FAE0000000E0000402F000200030004
ike V=root:0:5a88db4c560f15da/0000000000000000:23: responder received SA_INIT msg
ike V=root:0:5a88db4c560f15da/0000000000000000:23: VID forticlient connect license 4C53427B6D465D1B337BB755A37A7FEF706B9EBAF67F0000
ike V=root:0:5a88db4c560f15da/0000000000000000:23: VID Fortinet Endpoint Control B4F01CA951E9DA8D0BAFBBD34AD3044E906B9EBAF67F0000
ike V=root:0:5a88db4c560f15da/0000000000000000:23: VID Forticlient EAP Extension C1DC4350476B98A429B91781914CA43E202A8801FD010000
ike V=root:0:5a88db4c560f15da/0000000000000000:23: received notify type CLIENT_RESUME
ike V=root:0:5a88db4c560f15da/0000000000000000:23: received notify type FRAGMENTATION_SUPPORTED
ike V=root:0:5a88db4c560f15da/0000000000000000:23: received notify type NAT_DETECTION_SOURCE_IP
ike V=root:0:5a88db4c560f15da/0000000000000000:23: received notify type NAT_DETECTION_DESTINATION_IP
ike V=root:0:5a88db4c560f15da/0000000000000000:23: received notify type SIGNATURE_HASH_ALGORITHMS
ike V=root:0:5a88db4c560f15da/0000000000000000:23: incoming proposal:
ike V=root:0:5a88db4c560f15da/0000000000000000:23: proposal id = 1:
ike V=root:0:5a88db4c560f15da/0000000000000000:23:   protocol = IKEv2:
ike V=root:0:5a88db4c560f15da/0000000000000000:23:      encapsulation = IKEv2/none
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=ENCR, val=AES_GCM_16 (key_len = 256)
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=PRF, val=PRF_HMAC_SHA2_512
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=DH_GROUP, val=ECP521.
ike V=root:0:5a88db4c560f15da/0000000000000000:23: proposal id = 2:
ike V=root:0:5a88db4c560f15da/0000000000000000:23:   protocol = IKEv2:
ike V=root:0:5a88db4c560f15da/0000000000000000:23:      encapsulation = IKEv2/none
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=ENCR, val=AES_CBC (key_len = 256)
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=INTEGR, val=AUTH_HMAC_SHA2_256_128
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=PRF, val=PRF_HMAC_SHA
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=PRF, val=PRF_HMAC_SHA2_512
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=PRF, val=PRF_HMAC_SHA2_384
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=PRF, val=PRF_HMAC_SHA2_256
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=DH_GROUP, val=ECP521.
ike V=root:0: cache rebuild start
ike V=root:0:CERT-VPN: cached as wildcard, user peer 'EMS-SUBCA'
ike V=root:0:CERT-VPN: cached as dynamic, user peer 'EMS-SUBCA' subj='' cn=''
ike V=root:0: cache rebuild done
ike V=root:0:5a88db4c560f15da/0000000000000000:23: matched proposal id 1
ike V=root:0:5a88db4c560f15da/0000000000000000:23: proposal id = 1:
ike V=root:0:5a88db4c560f15da/0000000000000000:23:   protocol = IKEv2:
ike V=root:0:5a88db4c560f15da/0000000000000000:23:      encapsulation = IKEv2/none
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=ENCR, val=AES_GCM_16 (key_len = 256)
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=INTEGR, val=NONE
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=PRF, val=PRF_HMAC_SHA2_512
ike V=root:0:5a88db4c560f15da/0000000000000000:23:         type=DH_GROUP, val=ECP521.
ike V=root:0:5a88db4c560f15da/0000000000000000:23: lifetime=28800
ike V=root:0:5a88db4c560f15da/0000000000000000:23: SA proposal chosen, matched gateway CERT-VPN
ike V=root:0:CERT-VPN:23: sending CERTREQ payload (len=21)
ike V=root:0:CERT-VPN:23: certreq[0]: '85936D8D9D330144B1FBE59B30BE1EF36474F48F'
ike V=root:0:CERT-VPN:23: received peer identifier DER_ASN1_DN 'C = CA, ST = BC, L = Burnaby, O = Fortinet, CN = F3AB0220E981419CAA9A13CE4811E3F9'
ike V=root:0:CERT-VPN:23: match gw peer ID by FNBAM
ike V=root:0:CERT-VPN:23: Validating X.509 certificate
ike V=root:0:CERT-VPN:23: peer cert, subject='F3AB0220E981419CAA9A13CE4811E3F9', issuer='EMS_SUBCA'
ike V=root:0:CERT-VPN:23: peer ID verified
ike V=root:0:CERT-VPN:23: building fnbam peer candidate list
ike V=root:0:CERT-VPN:23: FNBAM_GROUP_NAME candidate 'EMS-SUBCA'
ike V=root:0:CERT-VPN:23: certificate validation pending
[323] fnbamd_chain_build-Chain discovery, opt 0x13, cur total 1
[341] fnbamd_chain_build-Following depth 0
[376] fnbamd_chain_build-Extend chain by system trust store. (good: 'EMS-SUBCA')
[341] fnbamd_chain_build-Following depth 1
[376] fnbamd_chain_build-Extend chain by system trust store. (good: 'FAC_ROOT')
[341] fnbamd_chain_build-Following depth 2
[355] fnbamd_chain_build-Self-sign detected.
[109] __cert_chg_st- 'Init' -> 'Validation'
[1025] __cert_verify-req_id=40737833275404
[1026] __cert_verify-Chain is complete.
[540] fnbamd_cert_verify-Chain number:3
[554] fnbamd_cert_verify-Following cert chain depth 0
[627] fnbamd_cert_verify-Issuer found: EMS-SUBCA (SSL_DPI opt 1)
[554] fnbamd_cert_verify-Following cert chain depth 1
[627] fnbamd_cert_verify-Issuer found: FAC_ROOT (SSL_DPI opt 1)
[554] fnbamd_cert_verify-Following cert chain depth 2
[1057] __cert_verify-peer_info.no_ocsp_query:0 cert->status:640.
[733] fnbamd_cert_check_group_list-checking group with name 'EMS-SUBCA'
[546] __check_add_peer-check 'EMS-SUBCA'
[422] peer_subject_cn_check-Cert subject 'C = CA, ST = BC, L = Burnaby, O = Fortinet, CN = F3AB0220E981419CAA9A13CE4811E3F9'
[553] __check_add_peer-'EMS-SUBCA' check ret:good
[668] __peer_user_clear_unmatched-Clear all user(s) other than 'EMS-SUBCA'
[689] __peer_user_clear_unmatched-
[202] __get_default_ocsp_ctx-def_ocsp_ctx=(nil), no_ocsp_query=0, ocsp_enabled=0
[806] fnbamd_cert_check_group_list-Peer users
[809] fnbamd_cert_check_group_list-    'EMS-SUBCA' ('N/A','N/A','N/A')
[1069] __cert_verify_do_next-req_id=40737833275404
[109] __cert_chg_st- 'Validation' -> 'Done'
[1163] __cert_done-req_id=40737833275404
[1567] fnbamd_auth_session_done-Session done, id=40737833275404
[1209] __fnbamd_cert_auth_run-Exit, req_id=40737833275404
[1610] create_auth_cert_session-fnbamd_cert_auth_init returns 0, id=40737833275404
[1523] auth_cert_success-id=40737833275404
[1321] fnbamd_cert_auth_copy_cert_status-req_id=40737833275404
[1329] fnbamd_cert_auth_copy_cert_status-Matched peer user 'EMS-SUBCA'
[914] fnbamd_cert_check_matched_groups-checking group with name 'EMS-SUBCA', peer_ctx->peer_user->setting.name:EMS-SUBCA
[975] fnbamd_cert_check_matched_groups-matched
[1361] fnbamd_cert_auth_copy_cert_status-Leaf cert status is unchecked.
[1452] fnbamd_cert_auth_copy_cert_status-Cert st 2c0, req_id=40737833275404
[279] fnbamd_comm_send_result-Sending result 0 (nid 672) for req 40737833275404, len=2611
[1398] destroy_auth_cert_session-id=40737833275404
[1293] fnbamd_cert_auth_uninit-req_id=40737833275404
ike V=root:0:CERT-VPN:23: fnbam reply 'EMS-SUBCA'
ike V=root:0:CERT-VPN:23: fnbam matched peer 'EMS-SUBCA'
[1985] fnbamd_ldaps_destroy-
ike V=root:0:CERT-VPN:23: certificate validation succeeded
[1667] fnbamd_rads_destroy-
[140] fnbamd_peer_ctx_free-Freeing peer ctx 'EMS-SUBCA'
ike V=root:0:CERT-VPN:23: signature verification succeeded
ike V=root:0:CERT-VPN:23: auth verify done
ike V=root:0:CERT-VPN:23: responder AUTH continuation
ike V=root:0:CERT-VPN:23: authentication succeeded
ike V=root:0:CERT-VPN:23: processing notify type FORTICLIENT_CONNECT
ike V=root:0:CERT-VPN:23: received FCT data len = 326, data = 'VER=1
FCTVER=7.4.6.2001
UID=F3AB0220E981419CAA9A13CE4811E3F9
IP=192.168.100.2
MAC=a4-bb-6d-13-07-2b;24-41-8c-fb-b1-b6;24-41-8c-fb-b1-b7;26-41-8c-fb-b1-b6;
HOST=FCXLAB
USER=labuser
OSVER=Microsoft Windows 8.0 Professional Edition, 64-bit (build 9200)
REG_STATUS=0
EMSSN=FCTEMSSERIAL
EMSID=00000000000000000000000000000000
'
ike V=root:0:CERT-VPN:23: received FCT-UID : F3AB0220E981419CAA9A13CE4811E3F9
ike V=root:0:CERT-VPN:23: received EMS SN : FCTEMSSERIAL
ike V=root:0:CERT-VPN:23: received EMS tenant ID : 00000000000000000000000000000000
ike V=root:0:CERT-VPN:23: received FCT-HOST : FCXLAB
ike V=root:0:CERT-VPN:23: responder creating new child
ike V=root:0:CERT-VPN:23: mode-cfg type 1 request 0:''
ike V=root:0:CERT-VPN: mode-cfg allocate 172.16.100.1/0.0.0.0
ike V=root:0:CERT-VPN:23: mode-cfg using allocated IPv4 172.16.100.1
ike V=root:0:CERT-VPN:23:8: peer proposal:
ike V=root:0:CERT-VPN:23:8: TSi_0 0:0.0.0.0-255.255.255.255:0
ike V=root:0:CERT-VPN:23:8: TSr_0 0:0.0.0.0-255.255.255.255:0
ike V=root:0:CERT-VPN:23:CERT-VPN:8: comparing selectors
ike V=root:0:CERT-VPN:23:CERT-VPN:8: matched by rfc-rule-2
ike V=root:0:CERT-VPN:23:CERT-VPN:8: phase2 matched by subset
ike V=root:0:CERT-VPN:23:CERT-VPN:8: using mode-cfg override 0:172.16.100.1-172.16.100.1:0
ike V=root:0:CERT-VPN:23:CERT-VPN:8: accepted proposal:
ike V=root:0:CERT-VPN:23:CERT-VPN:8: TSi_0 0:172.16.100.1-172.16.100.1:0
ike V=root:0:CERT-VPN:23:CERT-VPN:8: TSr_0 0:0.0.0.0-255.255.255.255:0
ike V=root:0:CERT-VPN:23:CERT-VPN:8: dialup
ike V=root:0:CERT-VPN:23:CERT-VPN:8: incoming child SA proposal:
ike V=root:0:CERT-VPN:23:CERT-VPN:8: proposal id = 1:
ike V=root:0:CERT-VPN:23:CERT-VPN:8:   protocol = ESP:
ike V=root:0:CERT-VPN:23:CERT-VPN:8:      encapsulation = TUNNEL
ike V=root:0:CERT-VPN:23:CERT-VPN:8:         type=ENCR, val=AES_GCM_16 (key_len = 128)
ike V=root:0:CERT-VPN:23:CERT-VPN:8:         type=ESN, val=NO
ike V=root:0:CERT-VPN:23:CERT-VPN:8:         PFS is disabled
ike V=root:0:CERT-VPN:23:CERT-VPN:8: proposal id = 2:
ike V=root:0:CERT-VPN:23:CERT-VPN:8:   protocol = ESP:
ike V=root:0:CERT-VPN:23:CERT-VPN:8:      encapsulation = TUNNEL
ike V=root:0:CERT-VPN:23:CERT-VPN:8:         type=ENCR, val=AES_CBC (key_len = 256)
ike V=root:0:CERT-VPN:23:CERT-VPN:8:         type=INTEGR, val=SHA256
ike V=root:0:CERT-VPN:23:CERT-VPN:8:         type=ESN, val=NO
ike V=root:0:CERT-VPN:23:CERT-VPN:8:         PFS is disabled
ike V=root:0:CERT-VPN:23:CERT-VPN:8: matched proposal id 2
ike V=root:0:CERT-VPN:23:CERT-VPN:8: proposal id = 2:
ike V=root:0:CERT-VPN:23:CERT-VPN:8:   protocol = ESP:
ike V=root:0:CERT-VPN:23:CERT-VPN:8:      encapsulation = TUNNEL
ike V=root:0:CERT-VPN:23:CERT-VPN:8:         type=ENCR, val=AES_CBC (key_len = 256)
ike V=root:0:CERT-VPN:23:CERT-VPN:8:         type=INTEGR, val=SHA256
ike V=root:0:CERT-VPN:23:CERT-VPN:8:         type=ESN, val=NO
ike V=root:0:CERT-VPN:23:CERT-VPN:8:         PFS is disabled
ike V=root:0:CERT-VPN:23:CERT-VPN:8: lifetime=3600
ike V=root:0:CERT-VPN:23: responder preparing AUTH msg
ike V=root:0:CERT-VPN: adding new dynamic tunnel for 192.168.100.2:51056
ike V=root:0:CERT-VPN_0: tunnel created tun_id 172.16.100.1/::10.0.0.10 remote_location 0.0.0.0
ike V=root:0:CERT-VPN_0: added new dynamic tunnel for 192.168.100.2:51056
ike V=root:0:CERT-VPN_0:23: local cert, subject='fgt-vpncert', issuer='FAC-ROOT'
ike V=root:0:CERT-VPN_0:23: mode-cfg assigned (1) IPv4 address 172.16.100.1
ike V=root:0:CERT-VPN_0:23: mode-cfg assigned (2) IPv4 netmask 255.255.255.255
ike V=root:0:CERT-VPN_0:23: mode-cfg send (13) 0:192.168.0.0/255.255.0.0:0
ike V=root:0:CERT-VPN_0:23: mode-cfg send (3) IPv4 DNS(1) 192.168.1.240
ike V=root:0:CERT-VPN_0:23:CERT-VPN:8: IPsec SA selectors #src=1 #dst=1
ike V=root:0:CERT-VPN_0:23:CERT-VPN:8: src 0 7 0:0.0.0.0-255.255.255.255:0
ike V=root:0:CERT-VPN_0:23:CERT-VPN:8: dst 0 7 0:172.16.100.1-172.16.100.1:0
ike V=root:0:CERT-VPN_0:23:CERT-VPN:8: add dynamic IPsec SA selectors 683
ike V=root:0:CERT-VPN_0:23:CERT-VPN:8: added dynamic IPsec SA proxyids new 1 683
ike V=root:0:CERT-VPN:8: add route 172.16.100.1/255.255.255.255 gw 172.16.100.1 oif CERT-VPN(36) metric 15 priority 1
ike V=root:0:CERT-VPN_0:23:CERT-VPN:8: tunnel 1 of VDOM limit 0/0
ike V=root:0:CERT-VPN_0:23:CERT-VPN:8: add IPsec SA: SPIs=78e2bc59/8dc65e44
ike V=root:0:CERT-VPN_0:23:CERT-VPN:8: added IPsec SA: SPIs=78e2bc59/8dc65e44
ike V=root:0:CERT-VPN_0:23:CERT-VPN:8: sending SNMP tunnel UP trap
ike V=root:0:CERT-VPN_0: tunnel up event assigned address 172.16.100.1
ike V=root:0:CERT-VPN_0: sent tunnel-up message to EMS: (fct-uid=F3AB0220E981419CAA9A13CE4811E3F9, intf=CERT-VPN_0, addr=172.16.100.1, vdom=root)
    1. We get the incoming connection with some FortiClient information as well as the IKE phase 1 proposal, so a gateway can be matched
    2. FortiClient sends the user certificate during the connection attempt (received peer identifier) and the peer cert, the EMS sub CA, gets taken from the configuration and passed to the fnbamd process for certificate validation.
    3. The certificate chain gets walked to find the possible issuers (Following cert chain)
    4. The EMS sub CA certificate provides a match (__check_add_peer-'EMS-SUBCA' check ret:good)
    5. The resulting CA gets returned to the ike process (fnbam reply 'EMS-SUBCA) and certificate validation is successful (certificate validation succeeded)
    6. The FortiClient data gets passed along, which could be used to restrict connections to only fabric-connected EMS servers by way of the EMS serial number, but this isn’t done here
    7. Regular IPsec phase 2 processes are done and we get a sending SNMP tunnel UP trap message, which we love to see

    VPN is looking good, so next up is SSL/TLS inspection.

    For SSL/TLS inspection

    I will be referring to SSL/TLS inspection as Deep Packet Inspection (DPI) going forward.

    When doing DPI, the client needs to trust the CA that is issuing the replaced certificate, and since we already did that in the EMS certificate management section, we only need to create an SSL/SSH inspection profile and configure firewall policies to use it.

    FortiGate DPI profile
    FortiGate DPI policy

    Remember that you need at least one other security profile in a policy for the SSL/SSH inspection profile to do anything, which is why I am using an application control and IPS profile. Without an additional security profile, it’s like no security profile is being used.

    If a client then, for example, browses to a website secured by HTTPS, we see that DPI does its thing, meaning the FortiGate replaces the certificate, and the connection is also trusted.

    Client DPI success

    DPI done, so on to 802.1X.

    A detour to configure FortiAuthenticator for EAP-TLS authentication with a FortiGate and FortiSwitch

    Initially, I didn’t want to explain how to configure FortiAuthenticator as a RADIUS server for EAP-TLS authentication and point to the documentation, but I couldn’t find an up-to-date example of it, so let’s quickly go through it.

    1. Make sure that at least RADIUS Auth is enabled on the FortiAuthenticator’s interface
    2. If it doesn’t already exist, create a Local Services certificate for EAP authentication in Certificate Management -> End Entities -> Local Services
      • This certificate may not have multiple SANs, but one is fine
    3. Assign the certificate as the EAP Server Certificate under Authentication -> RADIUS Service -> General
    4. Create a RADIUS client for the device that will send RADIUS requests
      • For this post, it is only the FortiGate’s IP since I NAT the FortiSwitch communication towards FortiAuthenticator
      • You don’t need it for 802.1X authentication, but you might as well enable the requirement for the Message-Authenticator attribute and also do it on the Network Access Server (NAS). For MAC Authentication Bypass (MAB), you need it anyway, and the attribute doesn’t hurt
    5. Create an Auth Profile with the Authentication type of Certificates and the EMS_SUBCA as a Trusted CA
    6. Create a RADIUS policy with your RADIUS client, the Client Credentials as EAP-TLS, and pick your Authentication Profile

    The configuration on the FortiGate is the same as always:

    1. Create a RADIUS server
    2. Create a group with that RADIUS server as a remote member
    3. Create a FortiSwitch Security Policy for 802.1X
      • You probably want MAC-based authentication so each client gets authenticated, not just the first one, like with port-based authentication
    4. Assign the security policy to a port
      • Don’t forget to enable the Security Policy column
    5. Create a firewall policy from your FortiLink interface to the RADIUS server that allows the RADIUS traffic
      • The FortiLink interface can only be assigned via the CLI
      • Optionally enable NAT on this policy if you want that, which I do

    The 802.1X configuration the FortiGate uses is in the GitHub repository linked above.

    With that completed, we can go back to the topic at hand.

    Actually…

    [Update 2026-06-07]: I have asked around a bit and got the feedback that the user certificate should not be removed if the client goes offline, which is also the experience I’ve had in the past. I have checked the release notes for EMS and FortiClient and couldn’t find anything that would hint at a change in behaviour or a bug, and I also updated FortiClient from 7.4.6 to 7.4.7, but this didn’t change anything. The user certificate continues to get removed shortly after I take the client offline. I will follow this topic, and hopefully I get to the bottom of it, because making 802.1X authentication possible in an easy manner would be great. In the meantime, you can test this behaviour yourself, and maybe you have a different experience. I can’t rule any configuration issues out on my side.

    [Update 2026-06-08]: I have found the root cause of the behaviour where FortiClient deletes the user certificate. The reason is that when writing this post, I used the CN EMS_SUBCA for the EMS sub CA. FortiClient’s FortiESNAC process, however, has a certificate check that runs in some situations, like when the client goes offline, and this check inspects the issuing CA for the user certificate and if the CN does not match the serial number of EMS, the user certificate gets deleted. Practically, this means that if you create your custom CA, the CN needs to match the EMS serial number. I have put this information further up, so people start with the correct information.

    We can see this behaviour in the FortiESNAC_1.log file (lots of lines in between are removed). I am presenting a case here where the serial number is not present in the CN.

    FortiESNAC debugs

    
[2026-06-08 11:02:31.6791578 UTC+02:00] [964:968] [FortiESNAC  894   error] Could not find the desired certificate FCTEMSSERIAL.
[2026-06-08 11:02:31.6791759 UTC+02:00] [964:968] [FortiESNAC  367    info] failed delete certificate in session 1
[2026-06-08 11:02:31.6810172 UTC+02:00] [964:968] [FortiESNAC  717   error] Could not find the desired CA certificate.
[2026-06-08 11:02:31.6816508 UTC+02:00] [964:968] [FortiESNAC  416   debug] result(1)
[2026-06-08 11:02:31.6816530 UTC+02:00] [964:968] [FortiESNAC  418   debug] dwCertSize(1464), dwPrivateKeySize(1188), dwCACertSize(1134), dwHigh(0), dwActualRead(1134), dwDerCertLen(782), pkiLen(1172)
[2026-06-08 11:02:31.6816538 UTC+02:00] [964:968] [FortiESNAC  422   debug] hCert(0), hPrivateKey(0), hCACert(0)
[2026-06-08 11:02:31.6816542 UTC+02:00] [964:968] [FortiESNAC  424   debug] PrivateKey(0), pPem(0), pCAPem(0), pKeyPem(0)
[2026-06-08 11:02:31.6870321 UTC+02:00] [964:968] [FortiESNAC  198    info] succeeded importing certificate in session 1
[2026-06-08 11:02:31.6928331 UTC+02:00] [964:968] [FortiESNAC  958   error] Could not find the desired certificate 6E23E7C3ABBF4FE797BB811A42F0A6F3.
[2026-06-08 11:02:31.6928521 UTC+02:00] [964:968] [FortiESNAC  96   debug] epctrl::ztna::SaveClientCertInfo 96 => GetClientCertificate failed
[2026-06-08 11:02:31.6928533 UTC+02:00] [964:968] [FortiESNAC  1022   error] Failed to output client certificate info
...
[2026-06-08 11:02:47.2217139 UTC+02:00] [964:968] [FortiESNAC  226    info] remove unmatched certificates
[2026-06-08 11:02:47.2241330 UTC+02:00] [964:968] [FortiESNAC  824    info] delete unmatched cert, subject: 6E23E7C3ABBF4FE797BB811A42F0A6F3, issuer: EMS_SUBCA
[2026-06-08 11:02:47.2265709 UTC+02:00] [964:968] [FortiESNAC  958   error] Could not find the desired certificate 6E23E7C3ABBF4FE797BB811A42F0A6F3.
[2026-06-08 11:02:47.2265925 UTC+02:00] [964:968] [FortiESNAC  231   debug] ShouldRequestCertificate return : 1
...
[2026-06-08 11:02:49.4696296 UTC+02:00] [964:968] [FortiESNAC  65 warning] Requesting new ZTNA client certificate: client certificate cannot be found on the system
[2026-06-08 11:02:49.4875478 UTC+02:00] [964:968] [FortiESNAC  497   debug] Request=MSG_HEADER: FCTUID=6E23E7C3ABBF4FE797BB811A42F0A6F3
FCTVER=7.4.7.2003
EMSSN=FCTEMSSERIAL
PROTO_VER=1.0.1
FCT_ONNET=1
CAPS=16777215
VDOM=default
EC_QUARANTINED=0
TOKEN=49F4***7042
SIZE=    1898

X-FCCK-KA: SYSINFO|...|
X-FCCK-KA-END


[2026-06-08 11:02:49.4875537 UTC+02:00] [964:968] [FortiESNAC  497   debug] >>>>> BEGIN CERT_REQ
[2026-06-08 11:02:49.4875541 UTC+02:00] [964:968] [FortiESNAC  497   debug] -----BEGIN CERTIFICATE REQUEST-----
[2026-06-08 11:02:49.4875545 UTC+02:00] [964:968] [FortiESNAC  497   debug] MIICrzCCAZcCAQAwajELMAkGA1UEBhMCQ0ExCzAJBgNVBAgMAkJDMRAwDgYDVQQH
[2026-06-08 11:02:49.4875547 UTC+02:00] [964:968] [FortiESNAC  497   debug] DAdCdXJuYWJ5MREwDwYDVQQKDAhGb3J0aW5ldDEpMCcGA1UEAwwgNkUyM0U3QzNB
[2026-06-08 11:02:49.4875550 UTC+02:00] [964:968] [FortiESNAC  497   debug] QkJGNEZFNzk3QkI4MTFBNDJGMEE2RjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
[2026-06-08 11:02:49.4875552 UTC+02:00] [964:968] [FortiESNAC  497   debug] ggEKAoIBAQCfB/yhfEoygLa3aWPW68O/J3vEWdNkO7tpK/F1coAOe8bvI4nXni/0
[2026-06-08 11:02:49.4875554 UTC+02:00] [964:968] [FortiESNAC  497   debug] djdMyeeEEz77aOeJXlZrKnpH4h+5RDOAjV+mFBjT2RqbI97kydMkXG1n/AmCUaXs
[2026-06-08 11:02:49.4875556 UTC+02:00] [964:968] [FortiESNAC  497   debug] +9iFvsB+cEVKdqf9C/179om02s6zZPCZRi46OZA5bkCTX/FAenjAKRz8NCdB0BGj
[2026-06-08 11:02:49.4875558 UTC+02:00] [964:968] [FortiESNAC  497   debug] WoACSSRN9f4z3Ovzgtg7k8V5UpxgUJgYO4h8/6OUtVwINt1YKMxV9BPLO+7g1ZLr
[2026-06-08 11:02:49.4875560 UTC+02:00] [964:968] [FortiESNAC  497   debug] a0Gm7oP8UKLQbml/1XvOQUlI3fVFtZ2MrnbQNqDqvRE7qjXl6lk97kzs/5KvOGXF
[2026-06-08 11:02:49.4875562 UTC+02:00] [964:968] [FortiESNAC  497   debug] 7wqxqqiNmzIOmhBcmT8t8oUe0ZvuGeYJAgMBAAGgADANBgkqhkiG9w0BAQsFAAOC
[2026-06-08 11:02:49.4875564 UTC+02:00] [964:968] [FortiESNAC  497   debug] AQEAWyjcMzwWHL1jahVLRAcoE4ed7nAnrOVqZN8MrK6kHEOarOHyt7+gzDoFcilP
[2026-06-08 11:02:49.4875566 UTC+02:00] [964:968] [FortiESNAC  497   debug] W+niR9Y3nmjVPDeYiv0oskwmtf8i/DfhWenh4CnvjoCBMcCogMiwR2EhUflq3ZQv
[2026-06-08 11:02:49.4875568 UTC+02:00] [964:968] [FortiESNAC  497   debug] 6tLy+p2IUpgd5HVIP/FkDHWaxYpQGp6qGHUIdyDxxY8U+WhmWUWTtWjC6oRRWZN0
[2026-06-08 11:02:49.4875570 UTC+02:00] [964:968] [FortiESNAC  497   debug] SJRtFH8zzOb/XcavxH1vEOW4+69kQOMujAamznUxw9xkKkFtPXuFCymDOZzYiFUq
[2026-06-08 11:02:49.4875574 UTC+02:00] [964:968] [FortiESNAC  497   debug] k7mhdd+U6yf18RADdH6UOD+mJeHAF0C0u9YSZX/N2k5ityPBXRTlDLY8AnXhvDVg
[2026-06-08 11:02:49.4875576 UTC+02:00] [964:968] [FortiESNAC  497   debug] potg5Ubn7wFLI2ainkBmEbDNpQ==
[2026-06-08 11:02:49.4875578 UTC+02:00] [964:968] [FortiESNAC  497   debug] -----END CERTIFICATE REQUEST-----
[2026-06-08 11:02:49.4875581 UTC+02:00] [964:968] [FortiESNAC  497   debug] <<<<< END   CERT_REQ
[2026-06-08 11:02:49.4875594 UTC+02:00] [964:968] [FortiESNAC  1060    info] Attempting to sync with EMS
[2026-06-08 11:02:49.4875612 UTC+02:00] [964:968] [FortiESNAC  111    info] Sending and Receiving from ems.ad.labdomain.com:8013
[2026-06-08 11:02:49.4876878 UTC+02:00] [964:968] [FortiESNAC  137   error] Failed to send data(10054): An existing connection was forcibly closed by the remote host.
[2026-06-08 11:02:49.4877791 UTC+02:00] [964:968] [FortiESNAC  1075   error] Could not contact the current server - backing up server address and trying other available servers

    The following process happens:

    1. FortiESNAC tries to find a certificate that has been issued by a CA with the EMS serial number as the CN, and if it doesn’t match, we see that the GetClientCertificate function fails:
      1. Could not find the desired certificate FCTEMSSERIAL
      2. Could not find the desired CA certificate
      3. epctrl::ztna::SaveClientCertInfo 96 => GetClientCertificate failed
    2. FortiESNAC removes the unmatched certificate, which is the user certificate that was already deployed
    3. A new ZTNA client certificate gets requested (Requesting new ZTNA client certificate: client certificate cannot be found on the system)
    4. EMS cannot be contacted for this, because the client is offline (Could not contact the current server - backing up server address and trying other available servers)

    With this information in mind, you can ignore the rest of this section, which I have marked for you.

    IGNORE BLOCK STARTS HERE

    I am so sorry for the detours, but it would be remiss of me not to mention the next part.

    One thing rears its ugly head when it comes to 802.1X and using the EMS user certificates, which is the fact that FortiClient will delete the user certificate if it loses the EMS connection. I was able to narrow it down to the Online/Offline status displayed on FortiClient, and in my testing, this status change took about 10 seconds.

    FortiClient Online/Offline

    This behaviour leads to the problem that user authentication for 802.1X cannot really work because, by definition, you don’t have network access before authentication and you can’t get the Online status.

    As a workaround, I (ab)used the guest VLAN function in the security policy. The idea is that a client fails, or doesn’t even attempt, the 802.1X authentication, falls back to MAB, which also fails, assuming you haven’t configured MAB, and arrives in the guest VLAN after some time. This VLAN allows a connection to EMS to get a certificate, and the client can complete the 802.1X authentication with this certificate.

    You can, of course, configure MAB as a fallback.

    You have to configure the following things for this:

    • Create a guest VLAN with all the necessary components, i.e. DHCP, DNS, etc.
    • Enable the Guest VLAN option in the FortiSwitch Security Policy
    • Set the Guest authentication delay to something reasonable
    • Enable MAC authentication bypass
    • Create a firewall policy allowing the necessary traffic
      • At a minimum, guests need to reach EMS over TCP/8013
      • Keep DNS in mind

    Once the client gets the certificate, he can, at least on Windows, easily sign in using the provided pop-up.

    This works for wired 802.1X. Wireless is another beast, and I got nothing here.

    Sorry, not everything is a winner. Maybe someone can help me in this regard.

    IGNORE BLOCK ENDS HERE

    For 802.1X with EAP-TLS

    Note: Much like with the VPN part, you cannot use the user certificate in a pre-logon scenario. You need a machine/computer certificate for that.

    802.1X with EAP-TLS really is the thing you want to secure your network access in the physical space, and thanks to the work we already did, all the pieces exist to make it a reality.

    FortiAuthenticator acts as the RADIUS/AAA server, the client has a user certificate and the CA certificates installed, and so we just need a layer 2 device to act as the NAS, and for me, this role is fulfilled by a FortiSwitch and a FortiAP.

    How to configure 802.1X with EAP-TLS was already handled, so here are just some additional points:

    • In the RADIUS policy on FortiAuthenticator, only certificates issued by the EMS_SUBCA are accepted, because those are the certificates the client presents
    • If your client is validating the RADIUS server certificate, you have to make sure that it uses the correct CA certificate for this. In my case, the server certificate comes from the FAC_ROOT CA
    • The two points already mentioned are important if you are using Windows group policies for this, because you want/need to restrict both the server validation CA, as well as the issuing CA, for simple certificate selection

    With a correctly configured client, we can check the 802.1X authentication state. First, wired, using the diagnose switch-controller switch-info 802.1X S424ENTFSERIAL portX command:

    diagnose switch-controller switch-info 802.1X S424ENTFSERIAL port2

Managed Switch : S424ENTFSERIAL

   port2 : Mode: port-based (mac-by-pass disable)
           Link: Link up
           Port State: authorized: (  )
           Dynamic Authorized Vlan : 0
           Dynamic Allowed Vlan list:
           Dynamic Untagged Vlan list:
           EAP pass-through : Enable
           EAP egress-frame-tagged : Enable
           EAP auto-untagged-vlans : Enable
           Allow MAC Move : Enable
           Dynamic Access Control List : Disable
           Quarantine VLAN (4093) detection : Enable
           Native Vlan : 11
           Allowed Vlan list: 11,4093
           Untagged Vlan list: 4093
           Guest VLAN :
           Auth-Fail Vlan :
           AuthServer-Timeout Vlan :

           Sessions info:
           00:e0:4c:68:00:14     Type=802.1x,TLS,state=AUTHENTICATED,etime=2,eap_cnt=8 params:reAuth=3600
           user="F3AB0220E981419CAA9A13CE4811E3F9",security_grp="FAC-RADIUS",radsec="disable":tunnel_id="-1", fortinet_grp=""

    We care about the state of AUTHENTICATED, and we can see that the user corresponds to the FortiClient ID, which we saw already in the VPN section.

    The FortiAuthenticator RADIUS debug of this is a standard and boring affair, but here it is:

    FortiAuthenticator wired 802.1X debugs

    2026-06-04T22:10:49.106876+02:00 FortiAuthenticator radiusd[1617]: Waking up in 0.3 seconds.
2026-06-04T22:10:49.107070+02:00 FortiAuthenticator radiusd[1617]: (58) Received Access-Request Id 9 from 192.168.1.202:40715 to 192.168.1.206:1812 length 192
2026-06-04T22:10:49.107093+02:00 FortiAuthenticator radiusd[1617]: (58)   NAS-Identifier = "S424ENTFSERIAL"
2026-06-04T22:10:49.107103+02:00 FortiAuthenticator radiusd[1617]: (58)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:10:49.107112+02:00 FortiAuthenticator radiusd[1617]: (58)   EAP-Message = 0x02ae0025014633414230323230453938313431394341413941313343453438313145334639
2026-06-04T22:10:49.107123+02:00 FortiAuthenticator radiusd[1617]: (58)   Framed-MTU = 1500
2026-06-04T22:10:49.107131+02:00 FortiAuthenticator radiusd[1617]: (58)   NAS-Port-Id = "port2"
2026-06-04T22:10:49.107141+02:00 FortiAuthenticator radiusd[1617]: (58)   NAS-Port = 2
2026-06-04T22:10:49.107154+02:00 FortiAuthenticator radiusd[1617]: (58)   NAS-Port-Type = Ethernet
2026-06-04T22:10:49.107162+02:00 FortiAuthenticator radiusd[1617]: (58)   Called-Station-Id = "38-C0-EA-12-E1-1D"
2026-06-04T22:10:49.107171+02:00 FortiAuthenticator radiusd[1617]: (58)   Calling-Station-Id = "00-E0-4C-68-00-14"
2026-06-04T22:10:49.107179+02:00 FortiAuthenticator radiusd[1617]: (58)   Message-Authenticator = 0x3a4a55af4f6cd773918c326b7bf9fea0
2026-06-04T22:10:49.107212+02:00 FortiAuthenticator radiusd[1617]: (58) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.107249+02:00 FortiAuthenticator radiusd[1617]: (58) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:10:49.107259+02:00 FortiAuthenticator radiusd[1617]: (58) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:10:49.107729+02:00 FortiAuthenticator radiusd[1617]: Not doing PAP as Auth-Type is already set.
2026-06-04T22:10:49.107772+02:00 FortiAuthenticator radiusd[1617]: (58) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.107794+02:00 FortiAuthenticator radiusd[1617]: (58) eap: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:10:49.107807+02:00 FortiAuthenticator radiusd[1617]: (58) eap: No policy matched for client:3 
2026-06-04T22:10:49.107816+02:00 FortiAuthenticator radiusd[1617]: (58) eap: Unable to find matching authpolicy (eap-teap) for RADIUS client with IP 192.168.1.202. 
2026-06-04T22:10:49.107825+02:00 FortiAuthenticator radiusd[1617]: (58) eap: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:10:49.107834+02:00 FortiAuthenticator radiusd[1617]: found 1 eap methods from authprofile 1 
2026-06-04T22:10:49.107843+02:00 FortiAuthenticator radiusd[1617]: (58) eap: No policy matched for client:3 
2026-06-04T22:10:49.107852+02:00 FortiAuthenticator radiusd[1617]: (58) eap: Unable to find matching authpolicy (password) for RADIUS client with IP 192.168.1.202. 
2026-06-04T22:10:49.107861+02:00 FortiAuthenticator radiusd[1617]: (58) eap: Found &control:EAP-Type = TLS
2026-06-04T22:10:49.108091+02:00 FortiAuthenticator radiusd[1617]: (58) eap: EAP session adding &reply:State = 0x2eb73cc92e183192
2026-06-04T22:10:49.108114+02:00 FortiAuthenticator radiusd[1617]: (58) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.108125+02:00 FortiAuthenticator radiusd[1617]: (58)   Framed-MTU = 984
2026-06-04T22:10:49.108423+02:00 FortiAuthenticator radiusd[1617]: (58) Sent Access-Challenge Id 9 from 192.168.1.206:1812 to 192.168.1.202:40715 length 64
2026-06-04T22:10:49.108448+02:00 FortiAuthenticator radiusd[1617]: (58)   EAP-Message = 0x01af00060d20
2026-06-04T22:10:49.108458+02:00 FortiAuthenticator radiusd[1617]: (58)   Message-Authenticator = 0x00000000000000000000000000000000
2026-06-04T22:10:49.108467+02:00 FortiAuthenticator radiusd[1617]: (58)   State = 0x2eb73cc92e18319234453ea63f84b1d2
2026-06-04T22:10:49.122656+02:00 FortiAuthenticator radiusd[1617]: Waking up in 0.3 seconds.
2026-06-04T22:10:49.122796+02:00 FortiAuthenticator radiusd[1617]: (59) Received Access-Request Id 10 from 192.168.1.202:51786 to 192.168.1.206:1812 length 612
2026-06-04T22:10:49.122812+02:00 FortiAuthenticator radiusd[1617]: (59)   NAS-Identifier = "S424ENTFSERIAL"
2026-06-04T22:10:49.122822+02:00 FortiAuthenticator radiusd[1617]: (59)   State = 0x2eb73cc92e18319234453ea63f84b1d2
2026-06-04T22:10:49.122830+02:00 FortiAuthenticator radiusd[1617]: (59)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:10:49.122842+02:00 FortiAuthenticator radiusd[1617]: (59)   EAP-Message = 0x02af01b50d80000001ab16030101a6010001a2030319c54d1690d23565d35135d739f63ebb8906ed0ae56265a88e5100bf414c71c2209abee7eff81b5b8e20c2d576a2c3580e1f8c80be7c85bc5dca9cbcf3d1616a81002813021301c02cc02bc030c02fc024c023c028c027c00ac009c014c013009d009c003d003c0035002f01000131000500050100000000002b0009080304030303020301000d001a001808040805080604010501020104030503020302020601060300230000000a00080006001d00170018000b00020100003300d000ce001d002069d0e993cf36ad15bf7d2d3869b9713f96aefaa67fcf7076092cf7386449863f0017004104b77bbd396ae12db22b35a29ac0d358c6cdae3f02ea42ac7a03e49c280142a6a114211e5f61efc448cf4a00444209d5bae83b3e0a984694a0341b879cd1d551710018006104495b00fcee8104bca8ecf4e69cb4b62c9712d6bed06563262169412615d3c96837fb8a78c06407e0100736bda70a31abb37afbdfa1
2026-06-04T22:10:49.122868+02:00 FortiAuthenticator radiusd[1617]: (59)   Framed-MTU = 1500
2026-06-04T22:10:49.122877+02:00 FortiAuthenticator radiusd[1617]: (59)   NAS-Port-Id = "port2"
2026-06-04T22:10:49.122886+02:00 FortiAuthenticator radiusd[1617]: (59)   NAS-Port = 2
2026-06-04T22:10:49.122895+02:00 FortiAuthenticator radiusd[1617]: (59)   NAS-Port-Type = Ethernet
2026-06-04T22:10:49.122897+02:00 FortiAuthenticator radiusd[1617]: (59)   Called-Station-Id = "38-C0-EA-12-E1-1D"
2026-06-04T22:10:49.122898+02:00 FortiAuthenticator radiusd[1617]: (59)   Calling-Station-Id = "00-E0-4C-68-00-14"
2026-06-04T22:10:49.122901+02:00 FortiAuthenticator radiusd[1617]: (59)   Message-Authenticator = 0xd9f2a52e4b2a46384e53481bdef26b51
2026-06-04T22:10:49.122906+02:00 FortiAuthenticator radiusd[1617]: (59) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.122938+02:00 FortiAuthenticator radiusd[1617]: (59) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:10:49.122942+02:00 FortiAuthenticator radiusd[1617]: (59) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:10:49.122945+02:00 FortiAuthenticator radiusd[1617]: (59) facauth: ===>Timestamp:1780603849.122568, age:0ms 
2026-06-04T22:10:49.122960+02:00 FortiAuthenticator radiusd[1617]: (59) facauth: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:10:49.122965+02:00 FortiAuthenticator radiusd[1617]: (59) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:10:49.122974+02:00 FortiAuthenticator radiusd[1617]: (59) facauth: Client type: external (subtype: radius) 
2026-06-04T22:10:49.123048+02:00 FortiAuthenticator radiusd[1617]: (59) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.123060+02:00 FortiAuthenticator radiusd[1617]: (59) eap: Removing EAP session with state 0x2eb73cc92e183192
2026-06-04T22:10:49.123069+02:00 FortiAuthenticator radiusd[1617]: (59) eap: Previous EAP request found for state 0x2eb73cc92e183192, released from the list
2026-06-04T22:10:49.124046+02:00 FortiAuthenticator radiusd[1617]: (59) eap: EAP session adding &reply:State = 0x2eb73cc92f073192
2026-06-04T22:10:49.124146+02:00 FortiAuthenticator radiusd[1617]: (59) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.124160+02:00 FortiAuthenticator radiusd[1617]: (59)   Framed-MTU = 984
2026-06-04T22:10:49.124170+02:00 FortiAuthenticator radiusd[1617]: (59)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello"
2026-06-04T22:10:49.124173+02:00 FortiAuthenticator radiusd[1617]: (59)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, ServerHello"
2026-06-04T22:10:49.124175+02:00 FortiAuthenticator radiusd[1617]: (59)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 ChangeCipherSpec"
2026-06-04T22:10:49.124177+02:00 FortiAuthenticator radiusd[1617]: (59)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, EncryptedExtensions"
2026-06-04T22:10:49.124179+02:00 FortiAuthenticator radiusd[1617]: (59)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateRequest"
2026-06-04T22:10:49.124181+02:00 FortiAuthenticator radiusd[1617]: (59)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Certificate"
2026-06-04T22:10:49.124183+02:00 FortiAuthenticator radiusd[1617]: (59)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateVerify"
2026-06-04T22:10:49.124185+02:00 FortiAuthenticator radiusd[1617]: (59)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Finished"
2026-06-04T22:10:49.124200+02:00 FortiAuthenticator radiusd[1617]: (59) Sent Access-Challenge Id 10 from 192.168.1.206:1812 to 192.168.1.202:51786 length 1054
2026-06-04T22:10:49.124204+02:00 FortiAuthenticator radiusd[1617]: (59)   EAP-Message = 0x01b003de0dc0000008cf160303009b0200009703032da7f1558fd723795a1a5c7a693a1db5b87b23534cc16a7bb3646e589010f984209abee7eff81b5b8e20c2d576a2c3580e1f8c80be7c85bc5dca9cbcf3d1616a81130200004f002b000203040033004500170041048da741a225ddaeabb51543bec7740f93bb4c69d03a5f4d1839034acd4ba0ac593581e149732c44950b5860e91099e06d5d2274239c3d5a63c8dfa9c6962aa6701403030001011703030023e8c102dd5346e1cfa119ce3af5c41cdda88a227726bdf8c6a9d1b89a3ce71874357d2a170303004612ec61490593ec5d62656164553e3ffd88996728d83bf680e0715924a23ff2bd217edd2c6ad78e7ebb48fb0c145ad395c90ad90cb4aa6de1e72988bdaf3d1e7511891dca77db170303064926fd85a9fc225815871d068d3f8f0efce31df7e81d33656d9370e209b9777b1d290f98c28310f87c884039299bdedec49e034190d197e36b7519fd0ed6b38f45e32f23331358ecf8e5551f5ca21208
2026-06-04T22:10:49.124206+02:00 FortiAuthenticator radiusd[1617]: (59)   Message-Authenticator = 0x00000000000000000000000000000000
2026-06-04T22:10:49.124288+02:00 FortiAuthenticator radiusd[1617]: (59)   State = 0x2eb73cc92f07319234453ea63f84b1d2
2026-06-04T22:10:49.128664+02:00 FortiAuthenticator radiusd[1617]: Waking up in 0.3 seconds.
2026-06-04T22:10:49.128692+02:00 FortiAuthenticator radiusd[1617]: (60) Received Access-Request Id 11 from 192.168.1.202:47130 to 192.168.1.206:1812 length 179
2026-06-04T22:10:49.128695+02:00 FortiAuthenticator radiusd[1617]: (60)   NAS-Identifier = "S424ENTFSERIAL"
2026-06-04T22:10:49.128698+02:00 FortiAuthenticator radiusd[1617]: (60)   State = 0x2eb73cc92f07319234453ea63f84b1d2
2026-06-04T22:10:49.128700+02:00 FortiAuthenticator radiusd[1617]: (60)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:10:49.128701+02:00 FortiAuthenticator radiusd[1617]: (60)   EAP-Message = 0x02b000060d00
2026-06-04T22:10:49.128704+02:00 FortiAuthenticator radiusd[1617]: (60)   Framed-MTU = 1500
2026-06-04T22:10:49.128707+02:00 FortiAuthenticator radiusd[1617]: (60)   NAS-Port-Id = "port2"
2026-06-04T22:10:49.128710+02:00 FortiAuthenticator radiusd[1617]: (60)   NAS-Port = 2
2026-06-04T22:10:49.128712+02:00 FortiAuthenticator radiusd[1617]: (60)   NAS-Port-Type = Ethernet
2026-06-04T22:10:49.128714+02:00 FortiAuthenticator radiusd[1617]: (60)   Called-Station-Id = "38-C0-EA-12-E1-1D"
2026-06-04T22:10:49.128800+02:00 FortiAuthenticator radiusd[1617]: (60)   Calling-Station-Id = "00-E0-4C-68-00-14"
2026-06-04T22:10:49.128809+02:00 FortiAuthenticator radiusd[1617]: (60)   Message-Authenticator = 0x3961365ff0a566189348a45fe1adc2f6
2026-06-04T22:10:49.128814+02:00 FortiAuthenticator radiusd[1617]: (60) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.128842+02:00 FortiAuthenticator radiusd[1617]: (60) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:10:49.128949+02:00 FortiAuthenticator radiusd[1617]: (60) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:10:49.128967+02:00 FortiAuthenticator radiusd[1617]: (60) facauth: ===>Timestamp:1780603849.128603, age:0ms 
2026-06-04T22:10:49.128990+02:00 FortiAuthenticator radiusd[1617]: (60) facauth: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:10:49.129002+02:00 FortiAuthenticator radiusd[1617]: (60) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:10:49.129014+02:00 FortiAuthenticator radiusd[1617]: (60) facauth: Client type: external (subtype: radius) 
2026-06-04T22:10:49.129021+02:00 FortiAuthenticator radiusd[1617]: (60) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.129025+02:00 FortiAuthenticator radiusd[1617]: (60) eap: Removing EAP session with state 0x2eb73cc92f073192
2026-06-04T22:10:49.129028+02:00 FortiAuthenticator radiusd[1617]: (60) eap: Previous EAP request found for state 0x2eb73cc92f073192, released from the list
2026-06-04T22:10:49.129037+02:00 FortiAuthenticator radiusd[1617]: (60) eap: EAP session adding &reply:State = 0x2eb73cc92c063192
2026-06-04T22:10:49.129043+02:00 FortiAuthenticator radiusd[1617]: (60) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.129045+02:00 FortiAuthenticator radiusd[1617]: (60)   Framed-MTU = 984
2026-06-04T22:10:49.129047+02:00 FortiAuthenticator radiusd[1617]: (60)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello"
2026-06-04T22:10:49.129049+02:00 FortiAuthenticator radiusd[1617]: (60)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, ServerHello"
2026-06-04T22:10:49.129051+02:00 FortiAuthenticator radiusd[1617]: (60)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 ChangeCipherSpec"
2026-06-04T22:10:49.129057+02:00 FortiAuthenticator radiusd[1617]: (60)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, EncryptedExtensions"
2026-06-04T22:10:49.129161+02:00 FortiAuthenticator radiusd[1617]: (60)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateRequest"
2026-06-04T22:10:49.129171+02:00 FortiAuthenticator radiusd[1617]: (60)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Certificate"
2026-06-04T22:10:49.129180+02:00 FortiAuthenticator radiusd[1617]: (60)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateVerify"
2026-06-04T22:10:49.129190+02:00 FortiAuthenticator radiusd[1617]: (60)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Finished"
2026-06-04T22:10:49.129212+02:00 FortiAuthenticator radiusd[1617]: (60) Sent Access-Challenge Id 11 from 192.168.1.206:1812 to 192.168.1.202:47130 length 1054
2026-06-04T22:10:49.129220+02:00 FortiAuthenticator radiusd[1617]: (60)   EAP-Message = 0x01b103de0dc0000008cf1b4ccea8c0217eabd736ac414b4cae59b7df2f4a51ffe685f4fbd039e486f21d1bb287342fc5267f98a7529c22a2d34a2eb04d5e100af0d836b057b97ac6674890284ca126a5a86fa4573f1642a6068c3b99608dc2521b7807c134c3765011af518d664055e8f9c5888ff15e4deb52e99dff8c1157c505489acc2463a056d381e97c0980c91c214c7a5d5c9c08f79e01820825dfdcbf758a62485ae88066fc2dad4995c819bee5a6d22e062d4c67f3241811e05242c945c018e9154f44c33490a3009b6172a79d029a00c3f8aa0cf9866908caab51f484409ec483872835702318ef5fb1b2d5f4382fe90b17d3fa3b959497b00deb7c825b16a0791a2443fc94c6f713017e69fab3857c66b2bac8216f34b3bc6f5e9baef6816d6720dc091400dcca504d9e9d2e7fb22ac08150ebf2745385c23522266d98962c6abd840a0ea7a67894417c951d6d38469998f593e15528b12ee08822d1c4629691fa72d22cd11d4f082d0bd24f475e8ae5b654
2026-06-04T22:10:49.129222+02:00 FortiAuthenticator radiusd[1617]: (60)   Message-Authenticator = 0x00000000000000000000000000000000
2026-06-04T22:10:49.129223+02:00 FortiAuthenticator radiusd[1617]: (60)   State = 0x2eb73cc92c06319234453ea63f84b1d2
2026-06-04T22:10:49.133259+02:00 FortiAuthenticator radiusd[1617]: (61) Received Access-Request Id 12 from 192.168.1.202:38086 to 192.168.1.206:1812 length 179
2026-06-04T22:10:49.133263+02:00 FortiAuthenticator radiusd[1617]: (61)   NAS-Identifier = "S424ENTFSERIAL"
2026-06-04T22:10:49.133265+02:00 FortiAuthenticator radiusd[1617]: (61)   State = 0x2eb73cc92c06319234453ea63f84b1d2
2026-06-04T22:10:49.133267+02:00 FortiAuthenticator radiusd[1617]: (61)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:10:49.133269+02:00 FortiAuthenticator radiusd[1617]: (61)   EAP-Message = 0x02b100060d00
2026-06-04T22:10:49.133271+02:00 FortiAuthenticator radiusd[1617]: (61)   Framed-MTU = 1500
2026-06-04T22:10:49.133272+02:00 FortiAuthenticator radiusd[1617]: (61)   NAS-Port-Id = "port2"
2026-06-04T22:10:49.133274+02:00 FortiAuthenticator radiusd[1617]: (61)   NAS-Port = 2
2026-06-04T22:10:49.133276+02:00 FortiAuthenticator radiusd[1617]: (61)   NAS-Port-Type = Ethernet
2026-06-04T22:10:49.133277+02:00 FortiAuthenticator radiusd[1617]: (61)   Called-Station-Id = "38-C0-EA-12-E1-1D"
2026-06-04T22:10:49.133279+02:00 FortiAuthenticator radiusd[1617]: (61)   Calling-Station-Id = "00-E0-4C-68-00-14"
2026-06-04T22:10:49.133295+02:00 FortiAuthenticator radiusd[1617]: (61)   Message-Authenticator = 0x402dbf8105f8a674ac29a89f68f9239b
2026-06-04T22:10:49.133320+02:00 FortiAuthenticator radiusd[1617]: (61) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.133341+02:00 FortiAuthenticator radiusd[1617]: (61) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:10:49.133354+02:00 FortiAuthenticator radiusd[1617]: (61) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:10:49.133365+02:00 FortiAuthenticator radiusd[1617]: (61) facauth: ===>Timestamp:1780603849.132900, age:0ms 
2026-06-04T22:10:49.133379+02:00 FortiAuthenticator radiusd[1617]: (61) facauth: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:10:49.133389+02:00 FortiAuthenticator radiusd[1617]: (61) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:10:49.133400+02:00 FortiAuthenticator radiusd[1617]: (61) facauth: Client type: external (subtype: radius) 
2026-06-04T22:10:49.133411+02:00 FortiAuthenticator radiusd[1617]: (61) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.133421+02:00 FortiAuthenticator radiusd[1617]: (61) eap: Removing EAP session with state 0x2eb73cc92c063192
2026-06-04T22:10:49.133430+02:00 FortiAuthenticator radiusd[1617]: (61) eap: Previous EAP request found for state 0x2eb73cc92c063192, released from the list
2026-06-04T22:10:49.133444+02:00 FortiAuthenticator radiusd[1617]: (61) eap: EAP session adding &reply:State = 0x2eb73cc92d053192
2026-06-04T22:10:49.133454+02:00 FortiAuthenticator radiusd[1617]: (61) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.133463+02:00 FortiAuthenticator radiusd[1617]: (61)   Framed-MTU = 984
2026-06-04T22:10:49.133538+02:00 FortiAuthenticator radiusd[1617]: (61)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello"
2026-06-04T22:10:49.133541+02:00 FortiAuthenticator radiusd[1617]: (61)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, ServerHello"
2026-06-04T22:10:49.133543+02:00 FortiAuthenticator radiusd[1617]: (61)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 ChangeCipherSpec"
2026-06-04T22:10:49.133544+02:00 FortiAuthenticator radiusd[1617]: (61)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, EncryptedExtensions"
2026-06-04T22:10:49.133547+02:00 FortiAuthenticator radiusd[1617]: (61)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateRequest"
2026-06-04T22:10:49.133549+02:00 FortiAuthenticator radiusd[1617]: (61)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Certificate"
2026-06-04T22:10:49.133550+02:00 FortiAuthenticator radiusd[1617]: (61)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateVerify"
2026-06-04T22:10:49.133552+02:00 FortiAuthenticator radiusd[1617]: (61)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Finished"
2026-06-04T22:10:49.133559+02:00 FortiAuthenticator radiusd[1617]: (61) Sent Access-Challenge Id 12 from 192.168.1.206:1812 to 192.168.1.202:38086 length 365
2026-06-04T22:10:49.133563+02:00 FortiAuthenticator radiusd[1617]: (61)   EAP-Message = 0x01b201310d80000008cf340423bfadf98a2922e39001ae82106a8fd4d570aa0b48c2cbb33f920e41123f3fee6e83a5c3b181111872c2fdcc34d5b46e8739946b036e739692946613ab48893fe5777a3f2806248461059541a52a3509ced40c00f6194ab2a2ee4cd48fce06e83cf19068d6e307e79c40518c2102ea18c8cce1d7898958590134dddac347123100b7383166d6e4d2c31b0222fa25b86ac6568368426d3263884d754eabeafc6c2c99aff9a1475cd6ceeae94a819980148d793d74924a94d6cabe55b5dbb4c8cf0ae152c013e8c232ca37577b90beb8803437f5efcc31b87bf057c41703030045c8ce9f66875ff465b29decf83fa0702107c0a3664475ffb2a10c86ad12ad14dfe6c597ec9ff2f9b3ba14485cd0b5ac796d2e6d2a878526a1dffa9e3f4c6202a66bf8b9e850
2026-06-04T22:10:49.133565+02:00 FortiAuthenticator radiusd[1617]: (61)   Message-Authenticator = 0x00000000000000000000000000000000
2026-06-04T22:10:49.133570+02:00 FortiAuthenticator radiusd[1617]: (61)   State = 0x2eb73cc92d05319234453ea63f84b1d2
2026-06-04T22:10:49.133706+02:00 FortiAuthenticator radiusd[1617]: Waking up in 0.3 seconds.
2026-06-04T22:10:49.143535+02:00 FortiAuthenticator radiusd[1617]: (62) Received Access-Request Id 13 from 192.168.1.202:33814 to 192.168.1.206:1812 length 1675
2026-06-04T22:10:49.143539+02:00 FortiAuthenticator radiusd[1617]: (62)   NAS-Identifier = "S424ENTFSERIAL"
2026-06-04T22:10:49.143541+02:00 FortiAuthenticator radiusd[1617]: (62)   State = 0x2eb73cc92d05319234453ea63f84b1d2
2026-06-04T22:10:49.143543+02:00 FortiAuthenticator radiusd[1617]: (62)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:10:49.143548+02:00 FortiAuthenticator radiusd[1617]: (62)   EAP-Message = 0x02b205d40dc000000876140303000101170303086b61f4a87189c7b2c5fd31d6550e2ffd96c145e89f9093026c1a182ae2afe0152849b54314ca1e22f3744ca20204b0f94876a1b4133f91bc3daea47c2ad34d158cd672bbc6956640d1f3ba5dd5d6c279c054672adca41d8f7dd817488047e4f149abb6c8a25e697b1f0327ca5503ad328e34a15c3ad6236f539821b91ae5d32db02aec92980dfd898bcebbd8545bb12b8cae0e605f7f8e0029d6ed6f0671ed1d709fe2dcfaf387484a568f2274e7f9d034ef3f1db1da35cde0565ee3b15801e3211002fba9b1b1ecaab980ae35fb8e3d121fb4e307522d3a23a790e6090ca6dd015dd8bbb2cae1d481ce651678fdc6b5abd71b425bf86440084e4178cfd91fea5a4c87bf1f4c75cb57d3448d6efb8bd42dc00cf61c11f0abe440309d3e151d4d85991505ffd8f5c28496bb5fa84fe1641fe5df438bfbc760d9649a9b81e73494d2250588ddf7d9412669a5b7cd5b95656166cdbae1423d8cce507cf7f6bbc023c1acaf
2026-06-04T22:10:49.143551+02:00 FortiAuthenticator radiusd[1617]: (62)   Framed-MTU = 1500
2026-06-04T22:10:49.143553+02:00 FortiAuthenticator radiusd[1617]: (62)   NAS-Port-Id = "port2"
2026-06-04T22:10:49.143556+02:00 FortiAuthenticator radiusd[1617]: (62)   NAS-Port = 2
2026-06-04T22:10:49.143558+02:00 FortiAuthenticator radiusd[1617]: (62)   NAS-Port-Type = Ethernet
2026-06-04T22:10:49.143561+02:00 FortiAuthenticator radiusd[1617]: (62)   Called-Station-Id = "38-C0-EA-12-E1-1D"
2026-06-04T22:10:49.143563+02:00 FortiAuthenticator radiusd[1617]: (62)   Calling-Station-Id = "00-E0-4C-68-00-14"
2026-06-04T22:10:49.143597+02:00 FortiAuthenticator radiusd[1617]: (62)   Message-Authenticator = 0x3bf73e2bcd0b2956cca1ebb35b148a03
2026-06-04T22:10:49.143648+02:00 FortiAuthenticator radiusd[1617]: (62) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.143766+02:00 FortiAuthenticator radiusd[1617]: (62) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:10:49.143769+02:00 FortiAuthenticator radiusd[1617]: (62) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:10:49.143773+02:00 FortiAuthenticator radiusd[1617]: (62) facauth: ===>Timestamp:1780603849.143409, age:0ms 
2026-06-04T22:10:49.143785+02:00 FortiAuthenticator radiusd[1617]: (62) facauth: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:10:49.143788+02:00 FortiAuthenticator radiusd[1617]: (62) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:10:49.143795+02:00 FortiAuthenticator radiusd[1617]: (62) facauth: Client type: external (subtype: radius) 
2026-06-04T22:10:49.143801+02:00 FortiAuthenticator radiusd[1617]: (62) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.143808+02:00 FortiAuthenticator radiusd[1617]: (62) eap: Removing EAP session with state 0x2eb73cc92d053192
2026-06-04T22:10:49.143810+02:00 FortiAuthenticator radiusd[1617]: (62) eap: Previous EAP request found for state 0x2eb73cc92d053192, released from the list
2026-06-04T22:10:49.143822+02:00 FortiAuthenticator radiusd[1617]: (62) eap: EAP session adding &reply:State = 0x2eb73cc92a043192
2026-06-04T22:10:49.143828+02:00 FortiAuthenticator radiusd[1617]: (62) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.143894+02:00 FortiAuthenticator radiusd[1617]: (62)   Framed-MTU = 984
2026-06-04T22:10:49.143898+02:00 FortiAuthenticator radiusd[1617]: (62)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello"
2026-06-04T22:10:49.143900+02:00 FortiAuthenticator radiusd[1617]: (62)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, ServerHello"
2026-06-04T22:10:49.143902+02:00 FortiAuthenticator radiusd[1617]: (62)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 ChangeCipherSpec"
2026-06-04T22:10:49.143904+02:00 FortiAuthenticator radiusd[1617]: (62)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, EncryptedExtensions"
2026-06-04T22:10:49.143906+02:00 FortiAuthenticator radiusd[1617]: (62)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateRequest"
2026-06-04T22:10:49.143907+02:00 FortiAuthenticator radiusd[1617]: (62)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Certificate"
2026-06-04T22:10:49.143909+02:00 FortiAuthenticator radiusd[1617]: (62)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateVerify"
2026-06-04T22:10:49.143911+02:00 FortiAuthenticator radiusd[1617]: (62)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Finished"
2026-06-04T22:10:49.143919+02:00 FortiAuthenticator radiusd[1617]: (62) Sent Access-Challenge Id 13 from 192.168.1.206:1812 to 192.168.1.202:33814 length 64
2026-06-04T22:10:49.143921+02:00 FortiAuthenticator radiusd[1617]: (62)   EAP-Message = 0x01b300060d00
2026-06-04T22:10:49.143998+02:00 FortiAuthenticator radiusd[1617]: (62)   Message-Authenticator = 0x00000000000000000000000000000000
2026-06-04T22:10:49.144000+02:00 FortiAuthenticator radiusd[1617]: (62)   State = 0x2eb73cc92a04319234453ea63f84b1d2
2026-06-04T22:10:49.144073+02:00 FortiAuthenticator radiusd[1617]: Waking up in 0.2 seconds.
2026-06-04T22:10:49.147269+02:00 FortiAuthenticator radiusd[1617]: Waking up in 0.2 seconds.
2026-06-04T22:10:49.147293+02:00 FortiAuthenticator radiusd[1617]: (63) Received Access-Request Id 14 from 192.168.1.202:58423 to 192.168.1.206:1812 length 867
2026-06-04T22:10:49.147296+02:00 FortiAuthenticator radiusd[1617]: (63)   NAS-Identifier = "S424ENTFSERIAL"
2026-06-04T22:10:49.147298+02:00 FortiAuthenticator radiusd[1617]: (63)   State = 0x2eb73cc92a04319234453ea63f84b1d2
2026-06-04T22:10:49.147299+02:00 FortiAuthenticator radiusd[1617]: (63)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:10:49.147304+02:00 FortiAuthenticator radiusd[1617]: (63)   EAP-Message = 0x02b302b20d005b72de3189aa76b9088a4c95e02ec75b72224f87cd6425f5f80d806913c615893c48bb686b35f934b55f955cda6e8b0374130d5741fc9d9efb593407c022793550cf01b5e5d2aad2827981e9bbc37f59632e21e3922a4a83e3ba1adc6c6dab3d778c7bb9fc4cb81fc15de6f41cb95fa5d66b7333d7f3dda9083059ffbacb5858f58130be7862bf4417d7232cce5894596d07a0a10cf3b7c5894a8d1f473dae122b409c4d1e6aba9da7908ce5be0c438bf3e090183e88722137b9073cfb48fd063b655c5e56d2355f24b5fd41ff4ba7572226b10e1a2ce8a9993c95172bf40c256a98e4209cfdf5f31b45e95c8cf7195838e71a0db56964e5e826b95e8c9f423ab21ead1b94a6b657ebba94ea96fe0fe96100f765222b1f628d31128694f938b0efd119b62c602336c0f49770da324b93caeea7babd5ec7aba1278d9694aca566363aae540774f90643cf29ca19af4c1374fb539512a659afedd62755e56054ae730c4d166e6db00e75f5173ab2425f2185
2026-06-04T22:10:49.147306+02:00 FortiAuthenticator radiusd[1617]: (63)   Framed-MTU = 1500
2026-06-04T22:10:49.147308+02:00 FortiAuthenticator radiusd[1617]: (63)   NAS-Port-Id = "port2"
2026-06-04T22:10:49.147310+02:00 FortiAuthenticator radiusd[1617]: (63)   NAS-Port = 2
2026-06-04T22:10:49.147312+02:00 FortiAuthenticator radiusd[1617]: (63)   NAS-Port-Type = Ethernet
2026-06-04T22:10:49.147314+02:00 FortiAuthenticator radiusd[1617]: (63)   Called-Station-Id = "38-C0-EA-12-E1-1D"
2026-06-04T22:10:49.147405+02:00 FortiAuthenticator radiusd[1617]: (63)   Calling-Station-Id = "00-E0-4C-68-00-14"
2026-06-04T22:10:49.147407+02:00 FortiAuthenticator radiusd[1617]: (63)   Message-Authenticator = 0x7b2a9075c333e8146820c94e3bec1430
2026-06-04T22:10:49.147411+02:00 FortiAuthenticator radiusd[1617]: (63) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.147427+02:00 FortiAuthenticator radiusd[1617]: (63) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:10:49.147433+02:00 FortiAuthenticator radiusd[1617]: (63) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:10:49.147435+02:00 FortiAuthenticator radiusd[1617]: (63) facauth: ===>Timestamp:1780603849.147225, age:0ms 
2026-06-04T22:10:49.147442+02:00 FortiAuthenticator radiusd[1617]: (63) facauth: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:10:49.147445+02:00 FortiAuthenticator radiusd[1617]: (63) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:10:49.147449+02:00 FortiAuthenticator radiusd[1617]: (63) facauth: Client type: external (subtype: radius) 
2026-06-04T22:10:49.147453+02:00 FortiAuthenticator radiusd[1617]: (63) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.147456+02:00 FortiAuthenticator radiusd[1617]: (63) eap: Removing EAP session with state 0x2eb73cc92a043192
2026-06-04T22:10:49.147502+02:00 FortiAuthenticator radiusd[1617]: (63) eap: Previous EAP request found for state 0x2eb73cc92a043192, released from the list
2026-06-04T22:10:49.148031+02:00 FortiAuthenticator radiusd[1617]: rlm_eap_tls: Certificate passed CRL check.
2026-06-04T22:10:49.148634+02:00 FortiAuthenticator radiusd[1617]: (63) eap_tls: rlm_eap_tls: Certificate check succeeded. (CN=F3AB0220E981419CAA9A13CE4811E3F9, Issuer=/CN=EMS_SUBCA)
2026-06-04T22:10:49.148794+02:00 FortiAuthenticator radiusd[1617]: rlm_eap_tls: Certificate passed CRL check.
2026-06-04T22:10:49.148901+02:00 FortiAuthenticator radiusd[1617]: (63) eap_tls: (TLS) EAP Sending final Commitment Message.
2026-06-04T22:10:49.148928+02:00 FortiAuthenticator radiusd[1617]: (63) eap: EAP session adding &reply:State = 0x2eb73cc92b033192
2026-06-04T22:10:49.148935+02:00 FortiAuthenticator radiusd[1617]: (63) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.148938+02:00 FortiAuthenticator radiusd[1617]: (63)   Framed-MTU = 984
2026-06-04T22:10:49.148941+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello"
2026-06-04T22:10:49.148943+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, ServerHello"
2026-06-04T22:10:49.148945+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 ChangeCipherSpec"
2026-06-04T22:10:49.148947+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, EncryptedExtensions"
2026-06-04T22:10:49.148974+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateRequest"
2026-06-04T22:10:49.148980+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Certificate"
2026-06-04T22:10:49.148983+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateVerify"
2026-06-04T22:10:49.149044+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Finished"
2026-06-04T22:10:49.149051+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 ChangeCipherSpec"
2026-06-04T22:10:49.149053+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, Certificate"
2026-06-04T22:10:49.149055+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Client-Cert-Common-Name += "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:10:49.149056+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Client-Cert-Issuer += "/CN=EMS_SUBCA"
2026-06-04T22:10:49.149058+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Client-Cert-X509v3-Authority-Key-Identifier += "7B:90:6C:7C:0F:E9:82:56:B9:CE:C2:CF:91:19:78:28:B5:B0:33:08"
2026-06-04T22:10:49.149060+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, CertificateVerify"
2026-06-04T22:10:49.149062+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, Finished"
2026-06-04T22:10:49.149064+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Cipher-Suite = "TLS_AES_256_GCM_SHA384"
2026-06-04T22:10:49.149065+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Version = "TLS 1.3"
2026-06-04T22:10:49.149067+02:00 FortiAuthenticator radiusd[1617]: (63)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Finished"
2026-06-04T22:10:49.149082+02:00 FortiAuthenticator radiusd[1617]: (63) Sent Access-Challenge Id 14 from 192.168.1.206:1812 to 192.168.1.202:58423 length 91
2026-06-04T22:10:49.149160+02:00 FortiAuthenticator radiusd[1617]: (63)   EAP-Message = 0x01b400210d800000001717030300128103fc2211821ecde823d968575e23b4d114
2026-06-04T22:10:49.149169+02:00 FortiAuthenticator radiusd[1617]: (63)   Message-Authenticator = 0x00000000000000000000000000000000
2026-06-04T22:10:49.149174+02:00 FortiAuthenticator radiusd[1617]: (63)   State = 0x2eb73cc92b03319234453ea63f84b1d2
2026-06-04T22:10:49.157079+02:00 FortiAuthenticator radiusd[1617]: Waking up in 0.2 seconds.
2026-06-04T22:10:49.157119+02:00 FortiAuthenticator radiusd[1617]: (64) Received Access-Request Id 15 from 192.168.1.202:58511 to 192.168.1.206:1812 length 179
2026-06-04T22:10:49.157124+02:00 FortiAuthenticator radiusd[1617]: (64)   NAS-Identifier = "S424ENTFSERIAL"
2026-06-04T22:10:49.157127+02:00 FortiAuthenticator radiusd[1617]: (64)   State = 0x2eb73cc92b03319234453ea63f84b1d2
2026-06-04T22:10:49.157129+02:00 FortiAuthenticator radiusd[1617]: (64)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:10:49.157153+02:00 FortiAuthenticator radiusd[1617]: (64)   EAP-Message = 0x02b400060d00
2026-06-04T22:10:49.157159+02:00 FortiAuthenticator radiusd[1617]: (64)   Framed-MTU = 1500
2026-06-04T22:10:49.157161+02:00 FortiAuthenticator radiusd[1617]: (64)   NAS-Port-Id = "port2"
2026-06-04T22:10:49.157164+02:00 FortiAuthenticator radiusd[1617]: (64)   NAS-Port = 2
2026-06-04T22:10:49.157167+02:00 FortiAuthenticator radiusd[1617]: (64)   NAS-Port-Type = Ethernet
2026-06-04T22:10:49.157169+02:00 FortiAuthenticator radiusd[1617]: (64)   Called-Station-Id = "38-C0-EA-12-E1-1D"
2026-06-04T22:10:49.157267+02:00 FortiAuthenticator radiusd[1617]: (64)   Calling-Station-Id = "00-E0-4C-68-00-14"
2026-06-04T22:10:49.157270+02:00 FortiAuthenticator radiusd[1617]: (64)   Message-Authenticator = 0xdd7180e060f358095d78ee4de24fd64c
2026-06-04T22:10:49.157276+02:00 FortiAuthenticator radiusd[1617]: (64) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.157302+02:00 FortiAuthenticator radiusd[1617]: (64) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:10:49.157304+02:00 FortiAuthenticator radiusd[1617]: (64) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:10:49.157308+02:00 FortiAuthenticator radiusd[1617]: (64) facauth: ===>Timestamp:1780603849.156995, age:0ms 
2026-06-04T22:10:49.157319+02:00 FortiAuthenticator radiusd[1617]: (64) facauth: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:10:49.157323+02:00 FortiAuthenticator radiusd[1617]: (64) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:10:49.157329+02:00 FortiAuthenticator radiusd[1617]: (64) facauth: Client type: external (subtype: radius) 
2026-06-04T22:10:49.157334+02:00 FortiAuthenticator radiusd[1617]: (64) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.157339+02:00 FortiAuthenticator radiusd[1617]: (64) eap: Removing EAP session with state 0x2eb73cc92b033192
2026-06-04T22:10:49.157373+02:00 FortiAuthenticator radiusd[1617]: (64) eap: Previous EAP request found for state 0x2eb73cc92b033192, released from the list
2026-06-04T22:10:49.157467+02:00 FortiAuthenticator radiusd[1617]: (64) # Executing section post-auth from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:10:49.157486+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::Framed-MTU += &session-state:Framed-MTU[*] -> 984
2026-06-04T22:10:49.157496+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 Handshake, ClientHello'
2026-06-04T22:10:49.157506+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, ServerHello'
2026-06-04T22:10:49.157515+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 ChangeCipherSpec'
2026-06-04T22:10:49.157539+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, EncryptedExtensions'
2026-06-04T22:10:49.157547+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, CertificateRequest'
2026-06-04T22:10:49.157552+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, Certificate'
2026-06-04T22:10:49.157554+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, CertificateVerify'
2026-06-04T22:10:49.157557+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, Finished'
2026-06-04T22:10:49.157559+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 ChangeCipherSpec'
2026-06-04T22:10:49.157561+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 Handshake, Certificate'
2026-06-04T22:10:49.157563+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Client-Cert-Common-Name += &session-state:TLS-Client-Cert-Common-Name[*] -> 'F3AB0220E981419CAA9A13CE4811E3F9'
2026-06-04T22:10:49.157565+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Client-Cert-Issuer += &session-state:TLS-Client-Cert-Issuer[*] -> '/CN=EMS_SUBCA'
2026-06-04T22:10:49.157568+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Client-Cert-X509v3-Authority-Key-Identifier += &session-state:TLS-Client-Cert-X509v3-Authority-Key-Identifier[*] -> '7B:90:6C:7C:0F:E9:82:56:B9:CE:C2:CF:91:19:78:28:B5:B0:33:08'
2026-06-04T22:10:49.157570+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 Handshake, CertificateVerify'
2026-06-04T22:10:49.157572+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 Handshake, Finished'
2026-06-04T22:10:49.157574+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[*] -> 'TLS_AES_256_GCM_SHA384'
2026-06-04T22:10:49.157618+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Version += &session-state:TLS-Session-Version[*] -> 'TLS 1.3'
2026-06-04T22:10:49.157621+02:00 FortiAuthenticator radiusd[1617]: (64)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, Finished'
2026-06-04T22:10:49.157624+02:00 FortiAuthenticator radiusd[1617]: (64) facauth: ========> FACAUTH POSTAUTH 
2026-06-04T22:10:49.157627+02:00 FortiAuthenticator radiusd[1617]: (64) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:10:49.157630+02:00 FortiAuthenticator radiusd[1617]: (64) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:10:49.157962+02:00 FortiAuthenticator radiusd[1617]: (64) facauth: Updated auth log 'F3AB0220E981419CAA9A13CE4811E3F9' for attempt from 192.168.1.202: 802.1x authentication (EAP-TLS) successful 
2026-06-04T22:10:49.157999+02:00 FortiAuthenticator radiusd[1617]: (64) Sent Access-Accept Id 15 from 192.168.1.206:1812 to 192.168.1.202:58511 length 200
2026-06-04T22:10:49.158001+02:00 FortiAuthenticator radiusd[1617]: (64)   Message-Authenticator := 0x00
2026-06-04T22:10:49.158003+02:00 FortiAuthenticator radiusd[1617]: (64)   MS-MPPE-Recv-Key = <<< secret >>>
2026-06-04T22:10:49.158047+02:00 FortiAuthenticator radiusd[1617]: (64)   MS-MPPE-Send-Key = <<< secret >>>
2026-06-04T22:10:49.158049+02:00 FortiAuthenticator radiusd[1617]: (64)   EAP-Message = 0x03b40004
2026-06-04T22:10:49.158051+02:00 FortiAuthenticator radiusd[1617]: (64)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:10:49.158053+02:00 FortiAuthenticator radiusd[1617]: (64)   Framed-MTU += 984

    For Wi-Fi connections, we can also see, on the CLI, that there is an authenticated user available using the diagnose firewall auth list command.

    diagnose firewall auth list

10.100.0.4, F3AB0220E981419CAA9A13CE4811E3F9
        type: other, id: 0, duration: 204, idled: 123
        flag(10): radius
        server: FAC
        packets: in 83 out 83, bytes: in 13099 out 7500

    Again, here are the boring FortiAuthenticator RADIUS debugs:

    FortiAuthenticator wireless 802.1X debugs

    2026-06-04T22:15:00.412912+02:00 FortiAuthenticator radiusd[1617]: (65) Received Access-Request Id 0 from 192.168.1.202:23356 to 192.168.1.206:1812 length 336
2026-06-04T22:15:00.412918+02:00 FortiAuthenticator radiusd[1617]: (65)   Message-Authenticator = 0x68cec83dc459ece9821670de46ac71ff
2026-06-04T22:15:00.412921+02:00 FortiAuthenticator radiusd[1617]: (65)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:15:00.412924+02:00 FortiAuthenticator radiusd[1617]: (65)   NAS-IP-Address = 0.0.0.0
2026-06-04T22:15:00.412926+02:00 FortiAuthenticator radiusd[1617]: (65)   NAS-Identifier = "10.10.10.2:5246-LAB"
2026-06-04T22:15:00.412928+02:00 FortiAuthenticator radiusd[1617]: (65)   Called-Station-Id = "04-01-A1-60-58-10:LAB"
2026-06-04T22:15:00.412930+02:00 FortiAuthenticator radiusd[1617]: (65)   NAS-Port-Type = Wireless-802.11
2026-06-04T22:15:00.412933+02:00 FortiAuthenticator radiusd[1617]: (65)   Service-Type = Framed-User
2026-06-04T22:15:00.412937+02:00 FortiAuthenticator radiusd[1617]: (65)   NAS-Port = 1
2026-06-04T22:15:00.412938+02:00 FortiAuthenticator radiusd[1617]: (65)   Fortinet-Vdom-Name = "root"
2026-06-04T22:15:00.412940+02:00 FortiAuthenticator radiusd[1617]: (65)   Fortinet-SSID = "LAB"
2026-06-04T22:15:00.412961+02:00 FortiAuthenticator radiusd[1617]: (65)   Fortinet-AP-Name = "FP241KTFSERIAL"
2026-06-04T22:15:00.412990+02:00 FortiAuthenticator radiusd[1617]: (65)   Calling-Station-Id = "24-41-8C-FB-B1-B6"
2026-06-04T22:15:00.412999+02:00 FortiAuthenticator radiusd[1617]: (65)   Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11N_2G"
2026-06-04T22:15:00.413008+02:00 FortiAuthenticator radiusd[1617]: (65)   Acct-Session-Id = "6A212F020000002A"
2026-06-04T22:15:00.413016+02:00 FortiAuthenticator radiusd[1617]: (65)   Acct-Multi-Session-Id = "0B07FEA15ADB8898"
2026-06-04T22:15:00.413025+02:00 FortiAuthenticator radiusd[1617]: (65)   WLAN-Pairwise-Cipher = 1027076
2026-06-04T22:15:00.413033+02:00 FortiAuthenticator radiusd[1617]: (65)   WLAN-Group-Cipher = 1027076
2026-06-04T22:15:00.413058+02:00 FortiAuthenticator radiusd[1617]: (65)   WLAN-AKM-Suite = 1027073
2026-06-04T22:15:00.413082+02:00 FortiAuthenticator radiusd[1617]: (65)   Framed-MTU = 1400
2026-06-04T22:15:00.413091+02:00 FortiAuthenticator radiusd[1617]: (65)   EAP-Message = 0x02190025014633414230323230453938313431394341413941313343453438313145334639
2026-06-04T22:15:00.413103+02:00 FortiAuthenticator radiusd[1617]: (65) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.413144+02:00 FortiAuthenticator radiusd[1617]: (65) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:15:00.413153+02:00 FortiAuthenticator radiusd[1617]: (65) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:15:00.413211+02:00 FortiAuthenticator radiusd[1617]: Not doing PAP as Auth-Type is already set.
2026-06-04T22:15:00.413222+02:00 FortiAuthenticator radiusd[1617]: (65) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.413238+02:00 FortiAuthenticator radiusd[1617]: (65) eap: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:15:00.413250+02:00 FortiAuthenticator radiusd[1617]: (65) eap: No policy matched for client:3 
2026-06-04T22:15:00.413259+02:00 FortiAuthenticator radiusd[1617]: (65) eap: Unable to find matching authpolicy (eap-teap) for RADIUS client with IP 192.168.1.202. 
2026-06-04T22:15:00.413855+02:00 FortiAuthenticator radiusd[1617]: (65) eap: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:15:00.413870+02:00 FortiAuthenticator radiusd[1617]: found 1 eap methods from authprofile 1 
2026-06-04T22:15:00.413875+02:00 FortiAuthenticator radiusd[1617]: (65) eap: No policy matched for client:3 
2026-06-04T22:15:00.413877+02:00 FortiAuthenticator radiusd[1617]: (65) eap: Unable to find matching authpolicy (password) for RADIUS client with IP 192.168.1.202. 
2026-06-04T22:15:00.413881+02:00 FortiAuthenticator radiusd[1617]: (65) eap: Found &control:EAP-Type = TLS
2026-06-04T22:15:00.413999+02:00 FortiAuthenticator radiusd[1617]: (65) eap: EAP session adding &reply:State = 0x4089863640938be4
2026-06-04T22:15:00.414010+02:00 FortiAuthenticator radiusd[1617]: (65) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.414013+02:00 FortiAuthenticator radiusd[1617]: (65)   Framed-MTU = 984
2026-06-04T22:15:00.414029+02:00 FortiAuthenticator radiusd[1617]: (65) Sent Access-Challenge Id 0 from 192.168.1.206:1812 to 192.168.1.202:23356 length 64
2026-06-04T22:15:00.414031+02:00 FortiAuthenticator radiusd[1617]: (65)   EAP-Message = 0x011a00060d20
2026-06-04T22:15:00.414033+02:00 FortiAuthenticator radiusd[1617]: (65)   Message-Authenticator = 0x00000000000000000000000000000000
2026-06-04T22:15:00.414100+02:00 FortiAuthenticator radiusd[1617]: (65)   State = 0x4089863640938be48ec08401850d17cb
2026-06-04T22:15:00.428717+02:00 FortiAuthenticator radiusd[1617]: Waking up in 0.3 seconds.
2026-06-04T22:15:00.429034+02:00 FortiAuthenticator radiusd[1617]: (66) Received Access-Request Id 1 from 192.168.1.202:23356 to 192.168.1.206:1812 length 756
2026-06-04T22:15:00.429039+02:00 FortiAuthenticator radiusd[1617]: (66)   Message-Authenticator = 0x46908590456de56e21be80fef082a211
2026-06-04T22:15:00.429041+02:00 FortiAuthenticator radiusd[1617]: (66)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:15:00.429044+02:00 FortiAuthenticator radiusd[1617]: (66)   NAS-IP-Address = 0.0.0.0
2026-06-04T22:15:00.429046+02:00 FortiAuthenticator radiusd[1617]: (66)   NAS-Identifier = "10.10.10.2:5246-LAB"
2026-06-04T22:15:00.429047+02:00 FortiAuthenticator radiusd[1617]: (66)   Called-Station-Id = "04-01-A1-60-58-10:LAB"
2026-06-04T22:15:00.429051+02:00 FortiAuthenticator radiusd[1617]: (66)   NAS-Port-Type = Wireless-802.11
2026-06-04T22:15:00.429054+02:00 FortiAuthenticator radiusd[1617]: (66)   Service-Type = Framed-User
2026-06-04T22:15:00.429055+02:00 FortiAuthenticator radiusd[1617]: (66)   NAS-Port = 1
2026-06-04T22:15:00.429057+02:00 FortiAuthenticator radiusd[1617]: (66)   Fortinet-Vdom-Name = "root"
2026-06-04T22:15:00.429059+02:00 FortiAuthenticator radiusd[1617]: (66)   Fortinet-SSID = "LAB"
2026-06-04T22:15:00.429194+02:00 FortiAuthenticator radiusd[1617]: (66)   Fortinet-AP-Name = "FP241KTFSERIAL"
2026-06-04T22:15:00.429198+02:00 FortiAuthenticator radiusd[1617]: (66)   Calling-Station-Id = "24-41-8C-FB-B1-B6"
2026-06-04T22:15:00.429200+02:00 FortiAuthenticator radiusd[1617]: (66)   Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11N_2G"
2026-06-04T22:15:00.429201+02:00 FortiAuthenticator radiusd[1617]: (66)   Acct-Session-Id = "6A212F020000002A"
2026-06-04T22:15:00.429203+02:00 FortiAuthenticator radiusd[1617]: (66)   Acct-Multi-Session-Id = "0B07FEA15ADB8898"
2026-06-04T22:15:00.429205+02:00 FortiAuthenticator radiusd[1617]: (66)   WLAN-Pairwise-Cipher = 1027076
2026-06-04T22:15:00.429206+02:00 FortiAuthenticator radiusd[1617]: (66)   WLAN-Group-Cipher = 1027076
2026-06-04T22:15:00.429208+02:00 FortiAuthenticator radiusd[1617]: (66)   WLAN-AKM-Suite = 1027073
2026-06-04T22:15:00.429210+02:00 FortiAuthenticator radiusd[1617]: (66)   Framed-MTU = 1400
2026-06-04T22:15:00.429215+02:00 FortiAuthenticator radiusd[1617]: (66)   EAP-Message = 0x021a01b50d80000001ab16030101a6010001a20303ad07be8db04e75b6e7521edaf284ea1fdb8fa04a4cfc8696742d890574b372562024e18e7cacc3e92109519fc46b14fa834b3869231a2e4cea35db4798c446bc50002813021301c02cc02bc030c02fc024c023c028c027c00ac009c014c013009d009c003d003c0035002f01000131000500050100000000002b0009080304030303020301000d001a001808040805080604010501020104030503020302020601060300230000000a00080006001d00170018000b00020100003300d000ce001d002018328c8bef2a0b0f500075c1ee5b43f178439e7acfcae6752f0affc6841c27200017004104f1e1dd85ba7f404e8fe2777ba6f0e58254a7c0e0753eca25ad10ce8fee6b72d5392900c74211eef408335f0c8440d7afc653f7d2263319be209ec4df7222e09600180061046801727e018e2566f6bcbcea358f7796276f4ea687f93eefef1ae0bfdb99765ed9b186d0d07e4a32b6b8a26699d56a8825f974dda0
2026-06-04T22:15:00.429216+02:00 FortiAuthenticator radiusd[1617]: (66)   State = 0x4089863640938be48ec08401850d17cb
2026-06-04T22:15:00.429295+02:00 FortiAuthenticator radiusd[1617]: (66) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.429325+02:00 FortiAuthenticator radiusd[1617]: (66) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:15:00.429327+02:00 FortiAuthenticator radiusd[1617]: (66) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:15:00.429331+02:00 FortiAuthenticator radiusd[1617]: (66) facauth: ===>Timestamp:1780604100.428628, age:0ms 
2026-06-04T22:15:00.429343+02:00 FortiAuthenticator radiusd[1617]: (66) facauth: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:15:00.429347+02:00 FortiAuthenticator radiusd[1617]: (66) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:15:00.429354+02:00 FortiAuthenticator radiusd[1617]: (66) facauth: Client type: external (subtype: radius) 
2026-06-04T22:15:00.429360+02:00 FortiAuthenticator radiusd[1617]: (66) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.429365+02:00 FortiAuthenticator radiusd[1617]: (66) eap: Removing EAP session with state 0x4089863640938be4
2026-06-04T22:15:00.429368+02:00 FortiAuthenticator radiusd[1617]: (66) eap: Previous EAP request found for state 0x4089863640938be4, released from the list
2026-06-04T22:15:00.430099+02:00 FortiAuthenticator radiusd[1617]: (66) eap: EAP session adding &reply:State = 0x4089863641928be4
2026-06-04T22:15:00.432648+02:00 FortiAuthenticator radiusd[1617]: (66) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.432668+02:00 FortiAuthenticator radiusd[1617]: (66)   Framed-MTU = 984
2026-06-04T22:15:00.432673+02:00 FortiAuthenticator radiusd[1617]: (66)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello"
2026-06-04T22:15:00.432675+02:00 FortiAuthenticator radiusd[1617]: (66)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, ServerHello"
2026-06-04T22:15:00.432677+02:00 FortiAuthenticator radiusd[1617]: (66)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 ChangeCipherSpec"
2026-06-04T22:15:00.432679+02:00 FortiAuthenticator radiusd[1617]: (66)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, EncryptedExtensions"
2026-06-04T22:15:00.432681+02:00 FortiAuthenticator radiusd[1617]: (66)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateRequest"
2026-06-04T22:15:00.432683+02:00 FortiAuthenticator radiusd[1617]: (66)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Certificate"
2026-06-04T22:15:00.432684+02:00 FortiAuthenticator radiusd[1617]: (66)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateVerify"
2026-06-04T22:15:00.432686+02:00 FortiAuthenticator radiusd[1617]: (66)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Finished"
2026-06-04T22:15:00.432710+02:00 FortiAuthenticator radiusd[1617]: (66) Sent Access-Challenge Id 1 from 192.168.1.206:1812 to 192.168.1.202:23356 length 1054
2026-06-04T22:15:00.432730+02:00 FortiAuthenticator radiusd[1617]: (66)   EAP-Message = 0x011b03de0dc0000008cf160303009b0200009703033dc1aed6c7dd0ffc0d1ff07eee8e42ce8a04bbbe06ffd16b0eafb3ef775943962024e18e7cacc3e92109519fc46b14fa834b3869231a2e4cea35db4798c446bc50130200004f002b00020304003300450017004104d303e88dd3b685dd05f69047629123b22e455965d83a05ecf56da30379f3809416446191e80315bbcce67ef2dbbd7d0cbb67a82430eeb07251417a6466b041ca1403030001011703030023700dcf52789585dadd15f0872b4837b1efa122fbcc2331316e92ddd0190e816fc37fae17030300464bb055288479dc828f32af7bc2add56c3c2f0339aa2d069f0b887e90024900decab19c34e2992d3ac2f25a56e6af5c50396566aeb2a3b1214e43a695dabd52ebc31aab7bd599170303064910c41698720cd20975bfb882c04d9418e4911e967f3beea9c6cb741872fd1e0b107004eb44e9a22c728917c6c81ce21342a26adff9f73c67302396db3b7111ebc229f9cfea85ece89cd6466d34221f
2026-06-04T22:15:00.432752+02:00 FortiAuthenticator radiusd[1617]: (66)   Message-Authenticator = 0x00000000000000000000000000000000
2026-06-04T22:15:00.432761+02:00 FortiAuthenticator radiusd[1617]: (66)   State = 0x4089863641928be48ec08401850d17cb
2026-06-04T22:15:00.440458+02:00 FortiAuthenticator radiusd[1617]: Waking up in 0.3 seconds.
2026-06-04T22:15:00.440551+02:00 FortiAuthenticator radiusd[1617]: (67) Received Access-Request Id 2 from 192.168.1.202:23356 to 192.168.1.206:1812 length 323
2026-06-04T22:15:00.440555+02:00 FortiAuthenticator radiusd[1617]: (67)   Message-Authenticator = 0x5d35fee7480011ef4b0094327853eeec
2026-06-04T22:15:00.440558+02:00 FortiAuthenticator radiusd[1617]: (67)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:15:00.440561+02:00 FortiAuthenticator radiusd[1617]: (67)   NAS-IP-Address = 0.0.0.0
2026-06-04T22:15:00.440562+02:00 FortiAuthenticator radiusd[1617]: (67)   NAS-Identifier = "10.10.10.2:5246-LAB"
2026-06-04T22:15:00.440564+02:00 FortiAuthenticator radiusd[1617]: (67)   Called-Station-Id = "04-01-A1-60-58-10:LAB"
2026-06-04T22:15:00.440567+02:00 FortiAuthenticator radiusd[1617]: (67)   NAS-Port-Type = Wireless-802.11
2026-06-04T22:15:00.440570+02:00 FortiAuthenticator radiusd[1617]: (67)   Service-Type = Framed-User
2026-06-04T22:15:00.440572+02:00 FortiAuthenticator radiusd[1617]: (67)   NAS-Port = 1
2026-06-04T22:15:00.440574+02:00 FortiAuthenticator radiusd[1617]: (67)   Fortinet-Vdom-Name = "root"
2026-06-04T22:15:00.440575+02:00 FortiAuthenticator radiusd[1617]: (67)   Fortinet-SSID = "LAB"
2026-06-04T22:15:00.440611+02:00 FortiAuthenticator radiusd[1617]: (67)   Fortinet-AP-Name = "FP241KTFSERIAL"
2026-06-04T22:15:00.440613+02:00 FortiAuthenticator radiusd[1617]: (67)   Calling-Station-Id = "24-41-8C-FB-B1-B6"
2026-06-04T22:15:00.440615+02:00 FortiAuthenticator radiusd[1617]: (67)   Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11N_2G"
2026-06-04T22:15:00.440616+02:00 FortiAuthenticator radiusd[1617]: (67)   Acct-Session-Id = "6A212F020000002A"
2026-06-04T22:15:00.440618+02:00 FortiAuthenticator radiusd[1617]: (67)   Acct-Multi-Session-Id = "0B07FEA15ADB8898"
2026-06-04T22:15:00.440620+02:00 FortiAuthenticator radiusd[1617]: (67)   WLAN-Pairwise-Cipher = 1027076
2026-06-04T22:15:00.440621+02:00 FortiAuthenticator radiusd[1617]: (67)   WLAN-Group-Cipher = 1027076
2026-06-04T22:15:00.440623+02:00 FortiAuthenticator radiusd[1617]: (67)   WLAN-AKM-Suite = 1027073
2026-06-04T22:15:00.440625+02:00 FortiAuthenticator radiusd[1617]: (67)   Framed-MTU = 1400
2026-06-04T22:15:00.440626+02:00 FortiAuthenticator radiusd[1617]: (67)   EAP-Message = 0x021b00060d00
2026-06-04T22:15:00.440628+02:00 FortiAuthenticator radiusd[1617]: (67)   State = 0x4089863641928be48ec08401850d17cb
2026-06-04T22:15:00.440638+02:00 FortiAuthenticator radiusd[1617]: (67) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.440692+02:00 FortiAuthenticator radiusd[1617]: (67) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:15:00.440702+02:00 FortiAuthenticator radiusd[1617]: (67) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:15:00.440712+02:00 FortiAuthenticator radiusd[1617]: (67) facauth: ===>Timestamp:1780604100.440383, age:0ms 
2026-06-04T22:15:00.440732+02:00 FortiAuthenticator radiusd[1617]: (67) facauth: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:15:00.440744+02:00 FortiAuthenticator radiusd[1617]: (67) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:15:00.440759+02:00 FortiAuthenticator radiusd[1617]: (67) facauth: Client type: external (subtype: radius) 
2026-06-04T22:15:00.440772+02:00 FortiAuthenticator radiusd[1617]: (67) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.440784+02:00 FortiAuthenticator radiusd[1617]: (67) eap: Removing EAP session with state 0x4089863641928be4
2026-06-04T22:15:00.440793+02:00 FortiAuthenticator radiusd[1617]: (67) eap: Previous EAP request found for state 0x4089863641928be4, released from the list
2026-06-04T22:15:00.440814+02:00 FortiAuthenticator radiusd[1617]: (67) eap: EAP session adding &reply:State = 0x4089863642958be4
2026-06-04T22:15:00.440826+02:00 FortiAuthenticator radiusd[1617]: (67) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.440835+02:00 FortiAuthenticator radiusd[1617]: (67)   Framed-MTU = 984
2026-06-04T22:15:00.440845+02:00 FortiAuthenticator radiusd[1617]: (67)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello"
2026-06-04T22:15:00.440853+02:00 FortiAuthenticator radiusd[1617]: (67)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, ServerHello"
2026-06-04T22:15:00.440862+02:00 FortiAuthenticator radiusd[1617]: (67)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 ChangeCipherSpec"
2026-06-04T22:15:00.440877+02:00 FortiAuthenticator radiusd[1617]: (67)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, EncryptedExtensions"
2026-06-04T22:15:00.440896+02:00 FortiAuthenticator radiusd[1617]: (67)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateRequest"
2026-06-04T22:15:00.440905+02:00 FortiAuthenticator radiusd[1617]: (67)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Certificate"
2026-06-04T22:15:00.440913+02:00 FortiAuthenticator radiusd[1617]: (67)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateVerify"
2026-06-04T22:15:00.440922+02:00 FortiAuthenticator radiusd[1617]: (67)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Finished"
2026-06-04T22:15:00.440942+02:00 FortiAuthenticator radiusd[1617]: (67) Sent Access-Challenge Id 2 from 192.168.1.206:1812 to 192.168.1.202:23356 length 1054
2026-06-04T22:15:00.440953+02:00 FortiAuthenticator radiusd[1617]: (67)   EAP-Message = 0x011c03de0dc0000008cf44daf571f4adb35b720800e8b0cb680aacdf9c950d71e475c4bc18216a59ce07f82fd359b07f7ddb2d49fe927ca4fa629792b516c9da27115be18133ce74e4e3ab0ea91a285843d9ba07c167902bd573ccb730ed946f74196f185f38e762df738fac5525253dc1ebe618d63ae6f3339e7bcec6732d7137b85f00d88e1944e5daab69ee48f062661470e374cbc5aa2b07a45fa2b1cde5f9894b5b2bb03f09aa0891afa09692bf0422a18e2dfdf8d54e26ce073c75b8198178e51c03b5820ca47884cf0354df34684ce842f5a4f86f7aac4d09b8edd788cf30e8076b4482407201907cc9abf80c5c5f214e06a957461365d20ea9d94c4dd0eff02f10f2cb0cc70ed9d3e9054e6532efaf55ce7b9c865f77e9e000ae1752663b1f22717daa6262da020f61561fe4eaf753d0a6e383ce029361b4caec4ed0d7ffa6fd44e533af29843adcc410883c0c629aaf8a24e64c1f9e972076a5579dcb66198c6bae00c1981b6fc3e6b9be5e0e62d4824ddf3e
2026-06-04T22:15:00.440962+02:00 FortiAuthenticator radiusd[1617]: (67)   Message-Authenticator = 0x00000000000000000000000000000000
2026-06-04T22:15:00.440970+02:00 FortiAuthenticator radiusd[1617]: (67)   State = 0x4089863642958be48ec08401850d17cb
2026-06-04T22:15:00.446416+02:00 FortiAuthenticator radiusd[1617]: Waking up in 0.2 seconds.
2026-06-04T22:15:00.446504+02:00 FortiAuthenticator radiusd[1617]: (68) Received Access-Request Id 3 from 192.168.1.202:23356 to 192.168.1.206:1812 length 323
2026-06-04T22:15:00.446508+02:00 FortiAuthenticator radiusd[1617]: (68)   Message-Authenticator = 0x65c013575d3732127c7494d3637b55be
2026-06-04T22:15:00.446510+02:00 FortiAuthenticator radiusd[1617]: (68)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:15:00.446512+02:00 FortiAuthenticator radiusd[1617]: (68)   NAS-IP-Address = 0.0.0.0
2026-06-04T22:15:00.446514+02:00 FortiAuthenticator radiusd[1617]: (68)   NAS-Identifier = "10.10.10.2:5246-LAB"
2026-06-04T22:15:00.446517+02:00 FortiAuthenticator radiusd[1617]: (68)   Called-Station-Id = "04-01-A1-60-58-10:LAB"
2026-06-04T22:15:00.446519+02:00 FortiAuthenticator radiusd[1617]: (68)   NAS-Port-Type = Wireless-802.11
2026-06-04T22:15:00.446522+02:00 FortiAuthenticator radiusd[1617]: (68)   Service-Type = Framed-User
2026-06-04T22:15:00.446524+02:00 FortiAuthenticator radiusd[1617]: (68)   NAS-Port = 1
2026-06-04T22:15:00.446525+02:00 FortiAuthenticator radiusd[1617]: (68)   Fortinet-Vdom-Name = "root"
2026-06-04T22:15:00.446527+02:00 FortiAuthenticator radiusd[1617]: (68)   Fortinet-SSID = "LAB"
2026-06-04T22:15:00.446574+02:00 FortiAuthenticator radiusd[1617]: (68)   Fortinet-AP-Name = "FP241KTFSERIAL"
2026-06-04T22:15:00.446576+02:00 FortiAuthenticator radiusd[1617]: (68)   Calling-Station-Id = "24-41-8C-FB-B1-B6"
2026-06-04T22:15:00.446578+02:00 FortiAuthenticator radiusd[1617]: (68)   Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11N_2G"
2026-06-04T22:15:00.446580+02:00 FortiAuthenticator radiusd[1617]: (68)   Acct-Session-Id = "6A212F020000002A"
2026-06-04T22:15:00.446581+02:00 FortiAuthenticator radiusd[1617]: (68)   Acct-Multi-Session-Id = "0B07FEA15ADB8898"
2026-06-04T22:15:00.446583+02:00 FortiAuthenticator radiusd[1617]: (68)   WLAN-Pairwise-Cipher = 1027076
2026-06-04T22:15:00.446584+02:00 FortiAuthenticator radiusd[1617]: (68)   WLAN-Group-Cipher = 1027076
2026-06-04T22:15:00.446586+02:00 FortiAuthenticator radiusd[1617]: (68)   WLAN-AKM-Suite = 1027073
2026-06-04T22:15:00.446588+02:00 FortiAuthenticator radiusd[1617]: (68)   Framed-MTU = 1400
2026-06-04T22:15:00.446590+02:00 FortiAuthenticator radiusd[1617]: (68)   EAP-Message = 0x021c00060d00
2026-06-04T22:15:00.446591+02:00 FortiAuthenticator radiusd[1617]: (68)   State = 0x4089863642958be48ec08401850d17cb
2026-06-04T22:15:00.446601+02:00 FortiAuthenticator radiusd[1617]: (68) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.446635+02:00 FortiAuthenticator radiusd[1617]: (68) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:15:00.446644+02:00 FortiAuthenticator radiusd[1617]: (68) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:15:00.446654+02:00 FortiAuthenticator radiusd[1617]: (68) facauth: ===>Timestamp:1780604100.446348, age:0ms 
2026-06-04T22:15:00.446678+02:00 FortiAuthenticator radiusd[1617]: (68) facauth: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:15:00.446688+02:00 FortiAuthenticator radiusd[1617]: (68) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:15:00.446702+02:00 FortiAuthenticator radiusd[1617]: (68) facauth: Client type: external (subtype: radius) 
2026-06-04T22:15:00.446715+02:00 FortiAuthenticator radiusd[1617]: (68) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.446727+02:00 FortiAuthenticator radiusd[1617]: (68) eap: Removing EAP session with state 0x4089863642958be4
2026-06-04T22:15:00.446736+02:00 FortiAuthenticator radiusd[1617]: (68) eap: Previous EAP request found for state 0x4089863642958be4, released from the list
2026-06-04T22:15:00.446753+02:00 FortiAuthenticator radiusd[1617]: (68) eap: EAP session adding &reply:State = 0x4089863643948be4
2026-06-04T22:15:00.446777+02:00 FortiAuthenticator radiusd[1617]: (68) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.446787+02:00 FortiAuthenticator radiusd[1617]: (68)   Framed-MTU = 984
2026-06-04T22:15:00.446796+02:00 FortiAuthenticator radiusd[1617]: (68)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello"
2026-06-04T22:15:00.446805+02:00 FortiAuthenticator radiusd[1617]: (68)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, ServerHello"
2026-06-04T22:15:00.446813+02:00 FortiAuthenticator radiusd[1617]: (68)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 ChangeCipherSpec"
2026-06-04T22:15:00.446822+02:00 FortiAuthenticator radiusd[1617]: (68)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, EncryptedExtensions"
2026-06-04T22:15:00.446831+02:00 FortiAuthenticator radiusd[1617]: (68)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateRequest"
2026-06-04T22:15:00.446839+02:00 FortiAuthenticator radiusd[1617]: (68)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Certificate"
2026-06-04T22:15:00.446848+02:00 FortiAuthenticator radiusd[1617]: (68)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateVerify"
2026-06-04T22:15:00.446856+02:00 FortiAuthenticator radiusd[1617]: (68)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Finished"
2026-06-04T22:15:00.446874+02:00 FortiAuthenticator radiusd[1617]: (68) Sent Access-Challenge Id 3 from 192.168.1.206:1812 to 192.168.1.202:23356 length 365
2026-06-04T22:15:00.446885+02:00 FortiAuthenticator radiusd[1617]: (68)   EAP-Message = 0x011d01310d80000008cf16c1506b049234082a7db8e0aa1ef2e847d0e8710d5c68fecaad43726935ac1f055ab27ad33e355a879800d4521f48bbd3b7ec8515844188d18c5cc36a644e8c62f4bd1a101ebcfd83fe78f55773f06af78fd220f240047f05bb931232eb0765780f62dfd0fb96de25ebae655f1e0b20a41bd12c9b66329c58f9e92e432b0029a36b9038f612e6f9044a1f887b8b3b36f8bdeb86bbe04e4fd0d3c29f557b842900912aeb1479eab3d9761c0f1cf41f5919ecda9c2765c163d5069c9ee51c1675d963f2a39375576a1500f8436d03f967cbd586f5de3c870173e118453317030300451df88fbe8bdba65d4076fb68b651e68c5c58ced14288bbc87f556ac87354abc94de8873a8f04fdf26582373b2bb0b0516e0d0f0d0aafb33f9303b02952767d338a79edcacc
2026-06-04T22:15:00.446894+02:00 FortiAuthenticator radiusd[1617]: (68)   Message-Authenticator = 0x00000000000000000000000000000000
2026-06-04T22:15:00.446902+02:00 FortiAuthenticator radiusd[1617]: (68)   State = 0x4089863643948be48ec08401850d17cb
2026-06-04T22:15:00.459684+02:00 FortiAuthenticator radiusd[1617]: Waking up in 0.2 seconds.
2026-06-04T22:15:00.459775+02:00 FortiAuthenticator radiusd[1617]: (69) Received Access-Request Id 4 from 192.168.1.202:23356 to 192.168.1.206:1812 length 1819
2026-06-04T22:15:00.459789+02:00 FortiAuthenticator radiusd[1617]: (69)   Message-Authenticator = 0xd0d668cce91a5520d600dbc18a88d3ae
2026-06-04T22:15:00.459799+02:00 FortiAuthenticator radiusd[1617]: (69)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:15:00.459808+02:00 FortiAuthenticator radiusd[1617]: (69)   NAS-IP-Address = 0.0.0.0
2026-06-04T22:15:00.459817+02:00 FortiAuthenticator radiusd[1617]: (69)   NAS-Identifier = "10.10.10.2:5246-LAB"
2026-06-04T22:15:00.459826+02:00 FortiAuthenticator radiusd[1617]: (69)   Called-Station-Id = "04-01-A1-60-58-10:LAB"
2026-06-04T22:15:00.459834+02:00 FortiAuthenticator radiusd[1617]: (69)   NAS-Port-Type = Wireless-802.11
2026-06-04T22:15:00.459844+02:00 FortiAuthenticator radiusd[1617]: (69)   Service-Type = Framed-User
2026-06-04T22:15:00.459852+02:00 FortiAuthenticator radiusd[1617]: (69)   NAS-Port = 1
2026-06-04T22:15:00.459861+02:00 FortiAuthenticator radiusd[1617]: (69)   Fortinet-Vdom-Name = "root"
2026-06-04T22:15:00.459869+02:00 FortiAuthenticator radiusd[1617]: (69)   Fortinet-SSID = "LAB"
2026-06-04T22:15:00.459877+02:00 FortiAuthenticator radiusd[1617]: (69)   Fortinet-AP-Name = "FP241KTFSERIAL"
2026-06-04T22:15:00.459886+02:00 FortiAuthenticator radiusd[1617]: (69)   Calling-Station-Id = "24-41-8C-FB-B1-B6"
2026-06-04T22:15:00.459894+02:00 FortiAuthenticator radiusd[1617]: (69)   Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11N_2G"
2026-06-04T22:15:00.459902+02:00 FortiAuthenticator radiusd[1617]: (69)   Acct-Session-Id = "6A212F020000002A"
2026-06-04T22:15:00.459911+02:00 FortiAuthenticator radiusd[1617]: (69)   Acct-Multi-Session-Id = "0B07FEA15ADB8898"
2026-06-04T22:15:00.459919+02:00 FortiAuthenticator radiusd[1617]: (69)   WLAN-Pairwise-Cipher = 1027076
2026-06-04T22:15:00.459928+02:00 FortiAuthenticator radiusd[1617]: (69)   WLAN-Group-Cipher = 1027076
2026-06-04T22:15:00.459937+02:00 FortiAuthenticator radiusd[1617]: (69)   WLAN-AKM-Suite = 1027073
2026-06-04T22:15:00.459945+02:00 FortiAuthenticator radiusd[1617]: (69)   Framed-MTU = 1400
2026-06-04T22:15:00.459956+02:00 FortiAuthenticator radiusd[1617]: (69)   EAP-Message = 0x021d05d40dc000000876140303000101170303086b6db62461bb97a4f122a484ff202fac2136da380f2234edbdc278e704e468092a859d08818e0bb64f42033fbfc397bd5e5e1aca8a0ace9ada2be8a319869ad25b17b76c5e32c9b8c374b62b66f6e0394e7e26b34c8269a7fb4e3e764531d27f66b8d2906971be2afc14a1d4e916c766affe901cc36603065fd2501b4fc3f2c4a20a7210ee7ac40bcec6f1ba80c046875f25780db78b249c5d8d200aa860746f43cd72b7ecc652545a7bd4a935638a5af646e2192c02eb066e1de242b7cf15124f47f55b1c5a9fb7fdffc16e3117d70cde1435b036716d62eda5340818253f4d46ee4712ddc4c99ef1c9348cb713d1e6c67f020157d3ed2dd5d692639e6d99fbaaade2082ee8d28cb39d540db6d24165e93e80127cb17210fb9819ab901e7715ee75eef27a42835948c27c6bf72f6309c2f06e0354cae1bee28fcc4d0c77eb5d0dd5afa5001f99803a2f05538db6cc8cfe9a8f2926f28ada89f3e944c58eaa367e12c5
2026-06-04T22:15:00.459976+02:00 FortiAuthenticator radiusd[1617]: (69)   State = 0x4089863643948be48ec08401850d17cb
2026-06-04T22:15:00.459988+02:00 FortiAuthenticator radiusd[1617]: (69) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.460018+02:00 FortiAuthenticator radiusd[1617]: (69) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:15:00.460027+02:00 FortiAuthenticator radiusd[1617]: (69) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:15:00.460038+02:00 FortiAuthenticator radiusd[1617]: (69) facauth: ===>Timestamp:1780604100.459620, age:0ms 
2026-06-04T22:15:00.460055+02:00 FortiAuthenticator radiusd[1617]: (69) facauth: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:15:00.460065+02:00 FortiAuthenticator radiusd[1617]: (69) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:15:00.460079+02:00 FortiAuthenticator radiusd[1617]: (69) facauth: Client type: external (subtype: radius) 
2026-06-04T22:15:00.460091+02:00 FortiAuthenticator radiusd[1617]: (69) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.460103+02:00 FortiAuthenticator radiusd[1617]: (69) eap: Removing EAP session with state 0x4089863643948be4
2026-06-04T22:15:00.460112+02:00 FortiAuthenticator radiusd[1617]: (69) eap: Previous EAP request found for state 0x4089863643948be4, released from the list
2026-06-04T22:15:00.460128+02:00 FortiAuthenticator radiusd[1617]: (69) eap: EAP session adding &reply:State = 0x4089863644978be4
2026-06-04T22:15:00.460139+02:00 FortiAuthenticator radiusd[1617]: (69) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.460149+02:00 FortiAuthenticator radiusd[1617]: (69)   Framed-MTU = 984
2026-06-04T22:15:00.460158+02:00 FortiAuthenticator radiusd[1617]: (69)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello"
2026-06-04T22:15:00.460167+02:00 FortiAuthenticator radiusd[1617]: (69)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, ServerHello"
2026-06-04T22:15:00.460176+02:00 FortiAuthenticator radiusd[1617]: (69)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 ChangeCipherSpec"
2026-06-04T22:15:00.460185+02:00 FortiAuthenticator radiusd[1617]: (69)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, EncryptedExtensions"
2026-06-04T22:15:00.460193+02:00 FortiAuthenticator radiusd[1617]: (69)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateRequest"
2026-06-04T22:15:00.460202+02:00 FortiAuthenticator radiusd[1617]: (69)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Certificate"
2026-06-04T22:15:00.460211+02:00 FortiAuthenticator radiusd[1617]: (69)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateVerify"
2026-06-04T22:15:00.460220+02:00 FortiAuthenticator radiusd[1617]: (69)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Finished"
2026-06-04T22:15:00.460234+02:00 FortiAuthenticator radiusd[1617]: (69) Sent Access-Challenge Id 4 from 192.168.1.206:1812 to 192.168.1.202:23356 length 64
2026-06-04T22:15:00.460243+02:00 FortiAuthenticator radiusd[1617]: (69)   EAP-Message = 0x011e00060d00
2026-06-04T22:15:00.460251+02:00 FortiAuthenticator radiusd[1617]: (69)   Message-Authenticator = 0x00000000000000000000000000000000
2026-06-04T22:15:00.460263+02:00 FortiAuthenticator radiusd[1617]: (69)   State = 0x4089863644978be48ec08401850d17cb
2026-06-04T22:15:00.476273+02:00 FortiAuthenticator radiusd[1617]: (70) Received Access-Request Id 5 from 192.168.1.202:23356 to 192.168.1.206:1812 length 1011
2026-06-04T22:15:00.476278+02:00 FortiAuthenticator radiusd[1617]: (70)   Message-Authenticator = 0xa85e0cb5813ceadc869b6326a24e6f1a
2026-06-04T22:15:00.476280+02:00 FortiAuthenticator radiusd[1617]: (70)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:15:00.476282+02:00 FortiAuthenticator radiusd[1617]: (70)   NAS-IP-Address = 0.0.0.0
2026-06-04T22:15:00.476284+02:00 FortiAuthenticator radiusd[1617]: (70)   NAS-Identifier = "10.10.10.2:5246-LAB"
2026-06-04T22:15:00.476286+02:00 FortiAuthenticator radiusd[1617]: (70)   Called-Station-Id = "04-01-A1-60-58-10:LAB"
2026-06-04T22:15:00.476290+02:00 FortiAuthenticator radiusd[1617]: (70)   NAS-Port-Type = Wireless-802.11
2026-06-04T22:15:00.476292+02:00 FortiAuthenticator radiusd[1617]: (70)   Service-Type = Framed-User
2026-06-04T22:15:00.476294+02:00 FortiAuthenticator radiusd[1617]: (70)   NAS-Port = 1
2026-06-04T22:15:00.476295+02:00 FortiAuthenticator radiusd[1617]: (70)   Fortinet-Vdom-Name = "root"
2026-06-04T22:15:00.476297+02:00 FortiAuthenticator radiusd[1617]: (70)   Fortinet-SSID = "LAB"
2026-06-04T22:15:00.476407+02:00 FortiAuthenticator radiusd[1617]: (70)   Fortinet-AP-Name = "FP241KTFSERIAL"
2026-06-04T22:15:00.476410+02:00 FortiAuthenticator radiusd[1617]: (70)   Calling-Station-Id = "24-41-8C-FB-B1-B6"
2026-06-04T22:15:00.476411+02:00 FortiAuthenticator radiusd[1617]: (70)   Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11N_2G"
2026-06-04T22:15:00.476413+02:00 FortiAuthenticator radiusd[1617]: (70)   Acct-Session-Id = "6A212F020000002A"
2026-06-04T22:15:00.476415+02:00 FortiAuthenticator radiusd[1617]: (70)   Acct-Multi-Session-Id = "0B07FEA15ADB8898"
2026-06-04T22:15:00.476417+02:00 FortiAuthenticator radiusd[1617]: (70)   WLAN-Pairwise-Cipher = 1027076
2026-06-04T22:15:00.476418+02:00 FortiAuthenticator radiusd[1617]: (70)   WLAN-Group-Cipher = 1027076
2026-06-04T22:15:00.476420+02:00 FortiAuthenticator radiusd[1617]: (70)   WLAN-AKM-Suite = 1027073
2026-06-04T22:15:00.476422+02:00 FortiAuthenticator radiusd[1617]: (70)   Framed-MTU = 1400
2026-06-04T22:15:00.476426+02:00 FortiAuthenticator radiusd[1617]: (70)   EAP-Message = 0x021e02b20d00af9261939df2ce2116bcb267909b4ce3097462f9fa5e5f5665eb5fb5c6e4a23b7af8c90a058d247e9b5cc831b56a7ed4e6685d4bd9dd3f8b6757d96b03ae05e369436fc23b625a7c5a5f695784d19cebd252a91eb2a005d78030be95d6efd7d7433804939a6b94f7b4e51980ed838b4da1d95f4538718b54966101baf15925c403a7ba80a20abdd5fa6ab17b00d892d13ce6e3b3c6322d60a3eca449b0876de8d1341473e0ec7cf244000db49c641702821314819f1683e1c6bb603d37fac99048b1236ff347cfecff7ba5f3414810a78b61e420a31d4ba7b7155c40e104887200b085107ecb3481a7ff86744b516fad6f56a8229301c33be4ff73a4ab809af6f9cb4f31a6ebeb3bf01572097f0e7f71810b707f0b4b22bb2490fe7a109eef0878c7140c6571ba91a8bc7b9aa113d8706b28201a38e8080ab3980e33f74e4757562cc7a4bdf4c82bf0cd6c341c9ada10c5e130684e20b477d69bc390d6d74e201ee5d9d972bae7b4d08e80a9b49b02c50e
2026-06-04T22:15:00.476428+02:00 FortiAuthenticator radiusd[1617]: (70)   State = 0x4089863644978be48ec08401850d17cb
2026-06-04T22:15:00.476495+02:00 FortiAuthenticator radiusd[1617]: (70) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.476518+02:00 FortiAuthenticator radiusd[1617]: (70) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:15:00.476521+02:00 FortiAuthenticator radiusd[1617]: (70) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:15:00.476523+02:00 FortiAuthenticator radiusd[1617]: (70) facauth: ===>Timestamp:1780604100.476181, age:0ms 
2026-06-04T22:15:00.476532+02:00 FortiAuthenticator radiusd[1617]: (70) facauth: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:15:00.476535+02:00 FortiAuthenticator radiusd[1617]: (70) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:15:00.476540+02:00 FortiAuthenticator radiusd[1617]: (70) facauth: Client type: external (subtype: radius) 
2026-06-04T22:15:00.476545+02:00 FortiAuthenticator radiusd[1617]: (70) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.476550+02:00 FortiAuthenticator radiusd[1617]: (70) eap: Removing EAP session with state 0x4089863644978be4
2026-06-04T22:15:00.476552+02:00 FortiAuthenticator radiusd[1617]: (70) eap: Previous EAP request found for state 0x4089863644978be4, released from the list
2026-06-04T22:15:00.477063+02:00 FortiAuthenticator radiusd[1617]: rlm_eap_tls: Certificate passed CRL check.
2026-06-04T22:15:00.477173+02:00 FortiAuthenticator radiusd[1617]: Waking up in 0.2 seconds.
2026-06-04T22:15:00.477610+02:00 FortiAuthenticator radiusd[1617]: (70) eap_tls: rlm_eap_tls: Certificate check succeeded. (CN=F3AB0220E981419CAA9A13CE4811E3F9, Issuer=/CN=EMS_SUBCA)
2026-06-04T22:15:00.477758+02:00 FortiAuthenticator radiusd[1617]: rlm_eap_tls: Certificate passed CRL check.
2026-06-04T22:15:00.477870+02:00 FortiAuthenticator radiusd[1617]: (70) eap_tls: (TLS) EAP Sending final Commitment Message.
2026-06-04T22:15:00.477893+02:00 FortiAuthenticator radiusd[1617]: (70) eap: EAP session adding &reply:State = 0x4089863645968be4
2026-06-04T22:15:00.477901+02:00 FortiAuthenticator radiusd[1617]: (70) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.477923+02:00 FortiAuthenticator radiusd[1617]: (70)   Framed-MTU = 984
2026-06-04T22:15:00.477928+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello"
2026-06-04T22:15:00.477930+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, ServerHello"
2026-06-04T22:15:00.477932+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 ChangeCipherSpec"
2026-06-04T22:15:00.477934+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, EncryptedExtensions"
2026-06-04T22:15:00.477936+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateRequest"
2026-06-04T22:15:00.477938+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Certificate"
2026-06-04T22:15:00.477940+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, CertificateVerify"
2026-06-04T22:15:00.478024+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Finished"
2026-06-04T22:15:00.478033+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 ChangeCipherSpec"
2026-06-04T22:15:00.478042+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, Certificate"
2026-06-04T22:15:00.478050+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Client-Cert-Common-Name += "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:15:00.478059+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Client-Cert-Issuer += "/CN=EMS_SUBCA"
2026-06-04T22:15:00.478068+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Client-Cert-X509v3-Authority-Key-Identifier += "7B:90:6C:7C:0F:E9:82:56:B9:CE:C2:CF:91:19:78:28:B5:B0:33:08"
2026-06-04T22:15:00.478077+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, CertificateVerify"
2026-06-04T22:15:00.478085+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, Finished"
2026-06-04T22:15:00.478094+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Cipher-Suite = "TLS_AES_256_GCM_SHA384"
2026-06-04T22:15:00.478102+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Version = "TLS 1.3"
2026-06-04T22:15:00.478118+02:00 FortiAuthenticator radiusd[1617]: (70)   TLS-Session-Information = "(TLS) TLS - send TLS 1.3 Handshake, Finished"
2026-06-04T22:15:00.478138+02:00 FortiAuthenticator radiusd[1617]: (70) Sent Access-Challenge Id 5 from 192.168.1.206:1812 to 192.168.1.202:23356 length 91
2026-06-04T22:15:00.478147+02:00 FortiAuthenticator radiusd[1617]: (70)   EAP-Message = 0x011f00210d8000000017170303001240b58b9b82ac678f565d68072899d09e553d
2026-06-04T22:15:00.478158+02:00 FortiAuthenticator radiusd[1617]: (70)   Message-Authenticator = 0x00000000000000000000000000000000
2026-06-04T22:15:00.478166+02:00 FortiAuthenticator radiusd[1617]: (70)   State = 0x4089863645968be48ec08401850d17cb
2026-06-04T22:15:00.482381+02:00 FortiAuthenticator radiusd[1617]: (71) Received Access-Request Id 6 from 192.168.1.202:23356 to 192.168.1.206:1812 length 323
2026-06-04T22:15:00.482386+02:00 FortiAuthenticator radiusd[1617]: (71)   Message-Authenticator = 0xc67c8744d1e42cd3a7426436aa79f26b
2026-06-04T22:15:00.482389+02:00 FortiAuthenticator radiusd[1617]: (71)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:15:00.482391+02:00 FortiAuthenticator radiusd[1617]: (71)   NAS-IP-Address = 0.0.0.0
2026-06-04T22:15:00.482393+02:00 FortiAuthenticator radiusd[1617]: (71)   NAS-Identifier = "10.10.10.2:5246-LAB"
2026-06-04T22:15:00.482395+02:00 FortiAuthenticator radiusd[1617]: (71)   Called-Station-Id = "04-01-A1-60-58-10:LAB"
2026-06-04T22:15:00.482397+02:00 FortiAuthenticator radiusd[1617]: (71)   NAS-Port-Type = Wireless-802.11
2026-06-04T22:15:00.482399+02:00 FortiAuthenticator radiusd[1617]: (71)   Service-Type = Framed-User
2026-06-04T22:15:00.482401+02:00 FortiAuthenticator radiusd[1617]: (71)   NAS-Port = 1
2026-06-04T22:15:00.482402+02:00 FortiAuthenticator radiusd[1617]: (71)   Fortinet-Vdom-Name = "root"
2026-06-04T22:15:00.482404+02:00 FortiAuthenticator radiusd[1617]: (71)   Fortinet-SSID = "LAB"
2026-06-04T22:15:00.482426+02:00 FortiAuthenticator radiusd[1617]: (71)   Fortinet-AP-Name = "FP241KTFSERIAL"
2026-06-04T22:15:00.482463+02:00 FortiAuthenticator radiusd[1617]: (71)   Calling-Station-Id = "24-41-8C-FB-B1-B6"
2026-06-04T22:15:00.482472+02:00 FortiAuthenticator radiusd[1617]: (71)   Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11N_2G"
2026-06-04T22:15:00.482481+02:00 FortiAuthenticator radiusd[1617]: (71)   Acct-Session-Id = "6A212F020000002A"
2026-06-04T22:15:00.482490+02:00 FortiAuthenticator radiusd[1617]: (71)   Acct-Multi-Session-Id = "0B07FEA15ADB8898"
2026-06-04T22:15:00.482498+02:00 FortiAuthenticator radiusd[1617]: (71)   WLAN-Pairwise-Cipher = 1027076
2026-06-04T22:15:00.482506+02:00 FortiAuthenticator radiusd[1617]: (71)   WLAN-Group-Cipher = 1027076
2026-06-04T22:15:00.482515+02:00 FortiAuthenticator radiusd[1617]: (71)   WLAN-AKM-Suite = 1027073
2026-06-04T22:15:00.482524+02:00 FortiAuthenticator radiusd[1617]: (71)   Framed-MTU = 1400
2026-06-04T22:15:00.482532+02:00 FortiAuthenticator radiusd[1617]: (71)   EAP-Message = 0x021f00060d00
2026-06-04T22:15:00.482540+02:00 FortiAuthenticator radiusd[1617]: (71)   State = 0x4089863645968be48ec08401850d17cb
2026-06-04T22:15:00.482552+02:00 FortiAuthenticator radiusd[1617]: (71) # Executing section authorize from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.482581+02:00 FortiAuthenticator radiusd[1617]: (71) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:15:00.482589+02:00 FortiAuthenticator radiusd[1617]: (71) facauth: ===>Username:F3AB0220E981419CAA9A13CE4811E3F9 
2026-06-04T22:15:00.482599+02:00 FortiAuthenticator radiusd[1617]: (71) facauth: ===>Timestamp:1780604100.482304, age:0ms 
2026-06-04T22:15:00.482614+02:00 FortiAuthenticator radiusd[1617]: (71) facauth: Found authclient from preloaded authclients list for 192.168.1.202: FGT (192.168.1.202) 
2026-06-04T22:15:00.482624+02:00 FortiAuthenticator radiusd[1617]: (71) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:15:00.482636+02:00 FortiAuthenticator radiusd[1617]: (71) facauth: Client type: external (subtype: radius) 
2026-06-04T22:15:00.482648+02:00 FortiAuthenticator radiusd[1617]: (71) # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.482658+02:00 FortiAuthenticator radiusd[1617]: (71) eap: Removing EAP session with state 0x4089863645968be4
2026-06-04T22:15:00.482668+02:00 FortiAuthenticator radiusd[1617]: (71) eap: Previous EAP request found for state 0x4089863645968be4, released from the list
2026-06-04T22:15:00.482748+02:00 FortiAuthenticator radiusd[1617]: (71) # Executing section post-auth from file /usr/etc/raddb/sites-enabled/default
2026-06-04T22:15:00.482765+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::Framed-MTU += &session-state:Framed-MTU[*] -> 984
2026-06-04T22:15:00.482775+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 Handshake, ClientHello'
2026-06-04T22:15:00.482784+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, ServerHello'
2026-06-04T22:15:00.482799+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 ChangeCipherSpec'
2026-06-04T22:15:00.482808+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, EncryptedExtensions'
2026-06-04T22:15:00.482817+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, CertificateRequest'
2026-06-04T22:15:00.482826+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, Certificate'
2026-06-04T22:15:00.482848+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, CertificateVerify'
2026-06-04T22:15:00.482857+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, Finished'
2026-06-04T22:15:00.482866+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 ChangeCipherSpec'
2026-06-04T22:15:00.482875+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 Handshake, Certificate'
2026-06-04T22:15:00.482884+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Client-Cert-Common-Name += &session-state:TLS-Client-Cert-Common-Name[*] -> 'F3AB0220E981419CAA9A13CE4811E3F9'
2026-06-04T22:15:00.482895+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Client-Cert-Issuer += &session-state:TLS-Client-Cert-Issuer[*] -> '/CN=EMS_SUBCA'
2026-06-04T22:15:00.482904+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Client-Cert-X509v3-Authority-Key-Identifier += &session-state:TLS-Client-Cert-X509v3-Authority-Key-Identifier[*] -> '7B:90:6C:7C:0F:E9:82:56:B9:CE:C2:CF:91:19:78:28:B5:B0:33:08'
2026-06-04T22:15:00.482914+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 Handshake, CertificateVerify'
2026-06-04T22:15:00.482923+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 Handshake, Finished'
2026-06-04T22:15:00.482931+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[*] -> 'TLS_AES_256_GCM_SHA384'
2026-06-04T22:15:00.482940+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Version += &session-state:TLS-Session-Version[*] -> 'TLS 1.3'
2026-06-04T22:15:00.482949+02:00 FortiAuthenticator radiusd[1617]: (71)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.3 Handshake, Finished'
2026-06-04T22:15:00.482959+02:00 FortiAuthenticator radiusd[1617]: (71) facauth: ========> FACAUTH POSTAUTH 
2026-06-04T22:15:00.482969+02:00 FortiAuthenticator radiusd[1617]: (71) facauth: ===>NAS IP:192.168.1.202 
2026-06-04T22:15:00.482980+02:00 FortiAuthenticator radiusd[1617]: (71) facauth: Found authpolicy 'EAP' (id 4) for client:'3' 
2026-06-04T22:15:00.483265+02:00 FortiAuthenticator radiusd[1617]: (71) facauth: Updated auth log 'F3AB0220E981419CAA9A13CE4811E3F9' for attempt from 192.168.1.202: 802.1x authentication (EAP-TLS) successful 
2026-06-04T22:15:00.483295+02:00 FortiAuthenticator radiusd[1617]: (71) Sent Access-Accept Id 6 from 192.168.1.206:1812 to 192.168.1.202:23356 length 200
2026-06-04T22:15:00.483297+02:00 FortiAuthenticator radiusd[1617]: (71)   Message-Authenticator := 0x00
2026-06-04T22:15:00.483298+02:00 FortiAuthenticator radiusd[1617]: (71)   MS-MPPE-Recv-Key = <<< secret >>>
2026-06-04T22:15:00.483300+02:00 FortiAuthenticator radiusd[1617]: (71)   MS-MPPE-Send-Key = <<< secret >>>
2026-06-04T22:15:00.483301+02:00 FortiAuthenticator radiusd[1617]: (71)   EAP-Message = 0x031f0004
2026-06-04T22:15:00.483303+02:00 FortiAuthenticator radiusd[1617]: (71)   User-Name = "F3AB0220E981419CAA9A13CE4811E3F9"
2026-06-04T22:15:00.483305+02:00 FortiAuthenticator radiusd[1617]: (71)   Framed-MTU += 984

    Something on the side that cost me more time than I want to admit: I was using an out-of-band connection for the Windows 11 client and was connected via RDP to it so I could test the wired 802.1X configuration from a different room, and I constantly got authentication failures displayed on the NIC. I checked the Windows Event Viewer and saw the following error message on every authentication attempt:

    Event ID 15514

Wired 802.1X Authentication failed.

	Network Adapter: Intel(R) Ethernet Connection (6) I219-V
	Interface GUID: {c8f64a9d-a891-4332-9e1e-1430095beadf}
	Peer Address: 000000000000
	Local Address: A4BB6D13072B
	Connection ID: 0xf
	Identity: -
	User: -
	Domain: -
	Reason: 0x50001
	Reason Text: Unable to identify a user for 802.1X authentication
	Error Code: 0x525

    I looked for a long time to find out why a user couldn’t be found for 802.1X authentication, because, in theory, everything is in order. I then physically went to the client, and the authentication immediately worked. I went back to my office, connected via RDP and was met with the same failure message. Turns out that 802.1X EAP-TLS with user authentication doesn’t work when you are connected via RDP. Maybe there is a setting somewhere that allows this, but it’s such an edge case that I didn’t want to spend more time on it.

    [Update 2026-06-19]: I recently found the reason, and 802.1X user authentication not working in an RDP session is expected and documented.

    For mobile devices

    If you have managed mobile devices, you might be able to use the EMS MDM Integration option to let your Android or iOS devices get a certificate from EMS if they are managed by one of the supported options.

    MDM Integration option

    In such a scenario, EMS acts as an SCEP server, reachable over TCP/4001 and TCP/4002, where mobile devices can request a certificate.

    Once you have the certificate, you can do much the same as with regular clients, so VPN and 802.1X.

    DPI is also possible, of course. If you can install the CA using your MDM, that saves you from having to do it manually using the certificates FortiClient gets from EMS.

    Covering this topic could be a post in itself, so I will leave you with the documentation for now.

    MDM Integration | FortiClient 7.4.7 | Fortinet Document Library

    Wrapping up

    Using EMS user certificates outside of their intended use, that is, ZTNA connections, is a niche use case, and provisioning certificates using other methods can be a better option, but if it fits your use case, this is a good alternative.
    The idea for this post actually came from a talk I had with Manuel Lehner from Fortinet at an event. He brainstormed some stuff with me, and I thought the topic was interesting enough to see how everything behaves. I am glad that I did, because I definitely learned something from this, and I hope you, dear reader, were able to take something of value with you while reading this.