Implement the interface name as the source IP address in RADIUS, LDAP, and DNS configurations

To account for dynamic IP address changes, such as those governed by SD-WAN rules, interface names can be used to define the source IP addresses in RADIUS, LDAP, and DNS configurations using the source-ip-interface command. The interface's current IP address will be used as the source IP address in the configuration; enhancing network flexibility and resolving potential connectivity issues. See RADIUS serversand LDAP servers for more information.

The following examples demonstrate configuring the interface name as the source IP address in RADIUS and LDAP servers, and local DNS databases, respectively. The server configuration on the FortiGate will need to have a source IP address included. This source IP address can be any interface, including the IP address of a loopback interface.

Example 1: RADIUS server

In this example, the loopback interface is used as the source IP address and the interface method is set to specify.

To configure the interface name as the source IP address in a RADIUS server:

1. Configure the loopback interface:

   config system interface
       edit "loop1"
           set vdom "vdom1"
           set ip 10.1.10.9 255.255.255.0
           set allowaccess ping
           set type loopback
       next
   end

2. Configure the RADIUS user object:

   config user radius
       edit "radius-142"
           set server "10.1.100.142"
           set secret XXXXXX
           set source-ip-interface "loop1"
           set interface-select-method specify
           set interface "testvlink1"   
       next
   end

3. Test the basic communication:

   1. Perform a local credential check with a known user and password:

      # diagnose test authserver radius radius-142 pap test1 test1
      authenticate 'test1' against 'pap' succeeded, server=primary assigned_rad_session_id=105510201667592 session_timeout=3600 secs idle_timeout=300 secs!
      Group membership(s) - group1

   2. Perform a sniffer check in a separate SSH session to verify that the source IP address contains the expected IP address of the loop interface:

      # diagnose sniffer packet any 'host 10.1.100.142 and port 1812' 4
      interfaces=[any]
      filters=[host 10.1.100.142 and port 1812]
      5.144791 testvlink1 out 10.1.10.9.17437 -> 10.1.100.142.1812: udp 110
      5.144794 testvlink0 in 10.1.10.9.17437 -> 10.1.100.142.1812: udp 110
      5.144812 port2 out 10.1.10.9.17437 -> 10.1.100.142.1812: udp 110
      5.149570 port2 in 10.1.100.142.1812 -> 10.1.10.9.17437: udp 169
      5.149581 testvlink0 out 10.1.100.142.1812 -> 10.1.10.9.17437: udp 169
      5.149583 testvlink1 in 10.1.100.142.1812 -> 10.1.10.9.17437: udp 169

Example 2: LDAP server

In this example, a VDOM link is used as the source IP address and the interface method is set to sdwan.

To configure the interface name as the source IP address in an LDAP server:

1. Configure the VDOM link:

   config system interface
       edit "testvlink1"
           set vdom "vdom1"
           set ip 10.12.1.10 255.255.255.0
           set allowaccess ping
           set type vdom-link
       next
   end

2. Configure the LDAP user object:

   config user ldap
       edit "ldap-2"
           set server "172.18.60.214"
           set source-ip-interface "testvlink1"
           set cnid "cn"
           set dn "dc=qafsso,dc=com"
           set type regular
           set username "cn=Manager,dc=qafsso,dc=com"
           set password ENC XXXXXXXXXXXXXXXXXXX
           set interface-select-method sdwan
       next
   end

3. Confirm in a packet capture that the correct IP address is used in the outgoing and incoming packets:

   # diagnose sniffer packet any  'port 389' 4
   interfaces=[any]
   filters=[port 389]
   11.356977 testvlink1 out 10.12.1.10.11742 -> 172.18.60.214.389: syn 1099805903 
   11.356979 testvlink0 in 10.12.1.10.11742 -> 172.18.60.214.389: syn 1099805903
   11.357001 port1 out 172.16.200.9.11742 -> 172.18.60.214.389: syn 1099805903
   11.357548 port1 in 172.18.60.214.389 -> 172.16.200.9.11742: syn 2083328609 ack 1099805904
   11.357556 testvlink0 out 172.18.60.214.389 -> 10.12.1.10.11742: syn 2083328609 ack 1099805904
   11.357558 testvlink1 in 172.18.60.214.389 -> 10.12.1.10.11742: syn 2083328609 ack 1099805904
   11.357566 testvlink1 out 10.12.1.10.11742 -> 172.18.60.214.389: ack 2083328610
   11.357564 testvlink0 in 10.12.1.10.11742 -> 172.18.60.214.389: ack 2083328610
   11.357571 port1 out 172.16.200.9.11742 -> 172.18.60.214.389: ack 2083328610

Example 3: DNS database

In this example, the system DNS database uses a customized DNS server and a loopback interface as the source IP address.

To configure the interface name as the source IP address in a DNS database:

1. Configure the loopback interface:

   config system interface
       edit "loop"
           set vdom "root"
           set ip 10.3.10.9 255.255.255.0
           set allowaccess ping
           set type loopback
           set role lan
           set snmp-index 28
       next
   end

2. Configure the DNS database:

   config system dns-database
       edit "1"
           set domain "fortinet-fsso.com"
           set authoritative disable
           set forwarder "10.1.100.150"
           set source-ip-interface "loop"
       next
   end

3. Clear the DNS host cache and ping any FQDN in the DNS domain:

   # execute ping login.fortinet-fsso.com
   PING login.fortinet-fsso.com (10.1.100.5): 56 data bytes
   64 bytes from 10.1.100.5: icmp_seq=0 ttl=255 time=0.1 ms
   64 bytes from 10.1.100.5: icmp_seq=1 ttl=255 time=0.0 ms
   64 bytes from 10.1.100.5: icmp_seq=2 ttl=255 time=0.0 ms
   64 bytes from 10.1.100.5: icmp_seq=3 ttl=255 time=0.0 ms
   64 bytes from 10.1.100.5: icmp_seq=4 ttl=255 time=0.0 ms
   
   --- login.fortinet-fsso.com ping statistics ---
   5 packets transmitted, 5 packets received, 0% packet loss
   round-trip min/avg/max = 0.0/0.0/0.1 ms

4. Perform a sniffer check on the FortiGate to confirm that the loopback interface was used as the source IP address in a DNS query:

   # diagnose sniffer packet any 'host 10.1.100.150 and port 53' 4
   interfaces=[any]
   filters=[host 10.1.100.150 and port 53]
   91.180362 port2 out 10.3.10.9.1328 -> 10.1.100.150.53: udp 41
   91.180733 port2 in 10.1.100.150.53 -> 10.3.10.9.1328: udp 57
   468.753163 port2 out 10.3.10.9.3990 -> 10.1.100.150.53: udp 41
   468.753533 port2 in 10.1.100.150.53 -> 10.3.10.9.3990: udp 57
   523.470007 port2 out 10.3.10.9.3990 -> 10.1.100.150.53: udp 44
   523.470017 port2 out 10.3.10.9.3990 -> 10.1.100.150.53: udp 45
   523.470025 port2 out 10.3.10.9.3990 -> 10.1.100.150.53: udp 47
   523.470350 port2 in 10.1.100.150.53 -> 10.3.10.9.3990: udp 60
   523.470380 port2 in 10.1.100.150.53 -> 10.3.10.9.3990: udp 85
   523.470396 port2 in 10.1.100.150.53 -> 10.3.10.9.3990: udp 95
   ^C
   10 packets received by filter
   0 packets dropped by kernel