pxGrid session subscription missing radius accounting session Id

d.blakemore — Wed, 16 Jul 2025 11:21:08 GMT

Hi

I'm building a custom middleware connector between FrotiOS 7.6 firewall and AIS as the native FortiNet connector does not work correctly for a multi node ISE deployment (we have 10 hardware nodes).

I have the FortiGate sending radius auth request to ISE which works correctly. The FortiGate then sends an accounting start message back to the ISE PSN's something like:

RADIUS Protocol
Code: Accounting-Request (4)
Packet identifier: 0x7f (127)
Length: 135
Authenticator: e64e88e1b0cadafb60171cbe309e2b30
Attribute Value Pairs
AVP: t=Acct-Status-Type(40) l=6 val=Start(1)
AVP: t=Event-Timestamp(55) l=6 val=Jul 16, 2025 14:19:38.000000000 AEST
AVP: t=Acct-Session-Id(44) l=18 val=00001e740050f041
AVP: t=User-Name(1) l=9 val=user
AVP: t=NAS-Identifier(32) l=12 val=nas
AVP: t=Framed-IP-Address(8) l=6 val=10.24.32.1
AVP: t=Vendor-Specific(26) l=12 vnd=Fortinet, Inc.(12356)
AVP: t=Vendor-Specific(26) l=12 vnd=Fortinet, Inc.(12356)
AVP: t=NAS-IP-Address(4) l=6 val=10.11.6.66
AVP: t=Called-Station-Id(30) l=12 val=10.11.6.66
AVP: t=Calling-Station-Id(31) l=16 val=125.168.63.113

my middleware is connected and subscribed to com.cisco.ise.session and com.cisco.ise.session.group

My problem is that when the session data arrives from the websocket it is missing the accounting session Id

  {
    "timestamp": "2025-07-16T15:44:25.245+10:00",
    "state": "STARTED",
    "userName": "user",
    "callingStationId": "125.168.63.113",
    "calledStationId": "10.11.6.66",
    "ipAddresses": ["10.24.32.1"],
    "nasIpAddress": "10.11.6.66",
    "nasIdentifier": "nas",
    "adNormalizedUser": "user",
    "providers": ["None"],
    "endpointCheckResult": "none",
    "identitySourcePortStart": 0,
    "identitySourcePortEnd": 0,
    "identitySourcePortFirst": 0,
    "networkDeviceProfileName": "Fortinet",
    "mdmRegistered": false,
    "mdmCompliant": false,
    "mdmDiskEncrypted": false,
    "mdmJailBroken": false,
    "mdmPinLocked": false,
    "selectedAuthzProfiles": ["PermitAccess"],
    "useCase": "Proxy",
    "ctsSecondarySecurityGroups": [],
    "sxpDomains": [],
    "inboundSgtDomainRules": [],
    "workloadClassification": [],
    "sessionSource": 0,
    "vrf": "",
    "destinationIPAddress": "10.254.254.52"
  }

I need to map group membership from a local redis table and generate a new radius request to send to the fortigate RSSO listener. it would be a more stable and scalable solution of I could get the AVP: t=Acct-Session-Id(44) l=18 val=00001e740050f041 sent back to me through pxGrid as the middleware host does not see the RADIUS sent to ISE. Is it possible to enable this somewhere in ISE?

Thanks
Dale

topic pxGrid session subscription missing radius accounting session Id in Network Security

pxGrid session subscription missing radius accounting session Id