RADIUS Accounting Interim-Update Packet Loss Causing Ghost Sessions
Truncation of the NAS-Port-Id attribute (Attribute 87) in FortiOS RADIUS Accounting-Request packets causes schema validation discards on Cisco ISE and FreeRADIUS, leaving orphaned "ghost" sessions active indefinitely and exhausting AAA endpoint licenses.
Technical Root Cause Analysis
When delivering 802.1X wired, wireless, or captive portal authentication, FortiOS sends RFC 2866 RADIUS accounting telemetry (Interim-Update and Accounting-Stop) to centralized AAA servers such as Cisco ISE, Aruba ClearPass, or FreeRADIUS via UDP port 1813.
To identify the originating interface, the FortiOS authd process generates RADIUS Attribute 87 (NAS-Port-Id) by combining the physical port name, aggregate link, and VLAN ID (e.g., fortilink.corp-trunk.vlan-guest-1002). In FortiOS builds prior to 7.2.8, the internal formatting buffer was constrained to a fixed 32-octet boundary.
When interface names exceed this limit, the buffer is sliced without an ASCII terminating null character, corrupting the TLV (Type-Length-Value) length field in the RADIUS header. Enterprise AAA servers enforcing strict RFC validation flag the packet as malformed and silently discard it without generating an Accounting-Response. Consequently, Accounting-Stop messages never clear user sessions, accumulating thousands of stale "ghost" records in ISE and ClearPass.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.4 – 7.2.7 | 7.2.8+ | Shorten interface name or use numeric port mapping |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | Upgrade to 7.4.2+ for expanded 253-byte buffer |
| FortiOS 7.0 | 7.0.10 – 7.0.13 | 7.0.14+ | Apply set nas-port-type override |
Platform Impact: FortiGate 100F to 600F appliances operating in campus or data center environments using FortiLink trunks, long VLAN names, and 802.1X / Captive Portal RADIUS accounting.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands to inspect the active RADIUS accounting queue and identify dropped or pending accounting frames:
Diagnostic Commands
# 1. Inspect the active authd accounting queue and packet drop statistics
diagnose test application authd 2
# 2. Monitor fnbamd RADIUS transactions and packet dispatch errors
diagnose debug reset
diagnose debug application fnbamd -1
diagnose debug enable
# 3. Check RADIUS server responsiveness and retransmission count
diagnose test application fnbamd 2
# 4. Turn off debugging once packet capture is complete
diagnose debug disableRemediation & Workaround Steps (Teaser Preview)
Step-by-step remediation procedures available in the interactive Ferrite platform:
Frequently Asked Questions
Interface names exceeding 32 octets cause authd to truncate the NAS-Port-Id attribute without setting a terminating null byte. The resulting TLV header length mismatch triggers silent packet discards on the AAA server.
AAA servers retain disconnected endpoints as active sessions, consuming concurrent user licenses, triggering false multi-login policy alerts, and distorting compliance audit logs.
The buffer was expanded to 253 bytes with proper null termination in FortiOS 7.2.8 and 7.4.2.