fortigate 6.0 load balancer virtual server

There is no need to assign a token to your monitor user as long as you are using a fixed passcode.Ensure you login with that user at least once to the RSA console because you’ll be asked to change it the first time.Setup a user with a fixed passcode in your RSA console.For RSA, create an account on RSA with the following parameters as mentioned by Jonathan Pitre: The RADIUS Monitor attempts to successfully log into the RADIUS server. Adjust the firewall to allow ping to the RADIUS servers.Īctive/passive load balancing – If you have RADIUS Servers in multiple datacenters, you can create multiple load balancing Virtual Servers, and cascade them so that the local RADIUS Servers are used first, and if they’re not available, then the Virtual Server fails over to RADIUS Servers in remote datacenters. The only other monitoring option is Ping.(Source = Stefano Losego in the comments) Microsoft Network Policy Server supports a fake Ping User-Name.Not as accurate as a successful login response, but better than ping. The monitor would be configured to expect a login failure response, which means that at least a RADIUS service is responding to the monitor. If you don’t mind failed login attempts in your RADIUS logs, you can specify fake credentials in your load balancing monitor.The credentials in the load balancing monitor must have a static password.

The RADIUS monitor will login to the RADIUS server and look for a response. RADIUS Monitor and Static Credentials – When load balancing RADIUS, you’ll want a monitor that verifies that the RADIUS server is functional.

Use the same RADIUS Secret for both appliances. However, if you are not locally load balancing RADIUS, then you’ll need to add the NSIP of both appliances as RADIUS Clients. For High Availability pairs, if you locally load balance RADIUS, then you only need to add the SNIP as a RADIUS Client, since the SNIP floats between the two appliances.Use the correct IP(s) when adding the NetScaler appliances as RADIUS Clients. When NetScaler uses a direct connection to a RADIUS Server without going through a load balancing Virtual Server, or uses a remote (different appliance) Load Balancing Virtual Server, the traffic is sourced from the NetScaler NSIP (NetScaler IP). When NetScaler uses a local (same appliance) load balanced Virtual Server for RADIUS authentication, the traffic is sourced from the NetScaler SNIP (Subnet IP). RADIUS Clients and Source IP – On your RADIUS servers, you’ll need to add the NetScaler appliances as RADIUS Clients. One method of two-factor authentication to NetScaler Gateway is the RADIUS protocol with a two-factor authentication product (tokens) that has RADIUS enabled. Monitor section has new build 56 instructions.

2017 Dec 25 – updated entire article for 12.0 build 56.

2018 Feb 17 – in RADIUS Monitor section, added Microsoft Network Policy Server Ping User-Name.

Fortigate 6.0 load balancer virtual server