FCSS-LED-AR-7-6: Fortinet NSE 6 - LAN Edge 7.6 ArchitectDemo

By Fortinet · Question Mode

QuestionQ19

Authentication

Refer to the exhibits, which show a network diagram Question Image and a RADIUS packet capture Question Image.

During analysis of a packet capture, a RADIUS Access-Request packet was observed being sent from FortiSwitch to FortiAuthenticator, passing through FortiGate. The capture shows that the User-Name attribute in the RADIUS Access-Request packet contains the client's MAC address.

Why does the User-Name attribute of the RADIUS Access-Request packet contain the client MAC address?

  • A FortiAuthenticator is authenticating the client based on the device hostname.
  • B FortiAuthenticator is performing machine authentication
  • C MAC address-based authentication is being used for the client through MAC Authentication Bypass (MAB).
  • D FortiGate is authenticating the client using 802.1X authentication.
Explanation

The network diagram identifies the client as a non-802.1X device, so it cannot perform 802.1X/EAP authentication, ruling out authentication via 802.1X on FortiGate or FortiSwitch. In the packet capture, the RADIUS Access-Request contains a Service-Type AVP set to Call-Check(10), and both the User-Name and Calling-Station-Id AVPs are set to the client's MAC address (70-88-6B-8C-4A-CE). This combination is the standard signature of MAC Authentication Bypass (MAB): because the endpoint cannot respond to 802.1X, FortiSwitch (the authenticator) substitutes the client's MAC address as the username (and password) in the RADIUS Access-Request sent to FortiAuthenticator, allowing the device to be authenticated/authorized based solely on its MAC address rather than 802.1X credentials or a machine/computer account.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!