Radius Accounting Worker Pool Hang during Peak Shift Change SSO Bursts
High-concurrency RADIUS accounting requests generated during shift-change SSO bursts block synchronous worker sockets inside /bin/authd, exhausting the worker pool and freezing captive portals and 802.1X authentications on FortiGate 100F to 1000F.
Technical Root Cause Analysis
The FortiOS authentication daemon (/bin/authd) orchestrates user credential verification, captive portal redirects, Single Sign-On (SSO) group mapping, and RADIUS protocol communications. In enterprise deployments utilizing 802.1X network access control or captive portal authentication, the firewall sends RADIUS Accounting Start, Interim-Update, and Stop records to external servers (Cisco ISE, Microsoft NPS, Aruba ClearPass, FreeRADIUS) over UDP port 1813.
In FortiOS versions 7.2.3 through 7.2.6, authd allocates a unified, synchronous worker thread pool (typically 16 to 32 worker threads) to process both high-priority user authentication handshakes and low-priority accounting records. When facility shift changes or mass morning logins trigger thousands of simultaneous authentication and accounting updates, slow responses or packet drops on UDP 1813 cause worker threads to block while awaiting server responses. Within seconds, all worker threads become occupied by hung accounting transactions. With no threads available to process incoming login queries, captive portal portals hang for 30 seconds before timing out, leaving users disconnected.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Workaround Strategy |
|---|---|---|---|
| FortiOS 7.2 | 7.2.3 – 7.2.6 | 7.2.7+ | Tune RADIUS timeout to 2s; decouple acct server |
| FortiOS 7.4 | 7.4.0 – 7.4.2 | 7.4.3+ | Upgrade to 7.4.3+ for async queue support |
| FortiOS 7.0 | 7.0.9 – 7.0.14 | 7.0.15+ | Reduce interim accounting interval frequency |
Platform Scope: Primarily impacts mid-range and enterprise FortiGate clusters (FG-100F, 200F, 400F, 600F, 1000F) providing wireless LAN controller (FortiAP) termination or campus 802.1X edge authentication.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands to inspect active authd worker thread distribution, dump RADIUS accounting queue depth, and check authentication memory usage:
Diagnostic Commands
# 1. Dump active authd worker thread status and queue utilization
diagnose test application authd 1
# 2. View active RADIUS server response latency and pending packet queues
diagnose test application authd 2
# 3. Check authd memory footprint and CPU utilization
diagnose sys top-mem 10 | grep authd
# 4. Filter crashlog for authd socket timeout and restart records
diagnose debug crashlog read | grep -i "authd"Remediation & Workaround Steps (Teaser Preview)
Follow the non-disruptive remediation guide in the Ferrite interactive platform to eliminate captive portal deadlocks immediately:
Frequently Asked Questions
A unified synchronous worker architecture inside authd allows slow or dropped RADIUS accounting packets to consume all available worker threads, preventing new user authentications from processing.
The captive portal web engine (httpsd) forwards user credentials to authd over an internal IPC socket. When authd is unresponsive due to thread starvation, httpsd times out after 30 seconds and returns error 504.
No. Lowering the RADIUS timeout from 5 seconds to 2 seconds simply ensures hung transactions fail fast, releasing threads back to the pool to process active user requests.