Hi
I'm building a custom middleware connector between FrotiOS 7.6 firewall and AIS as the native FortiNet connector does not work correctly for a multi node ISE deployment (we have 10 hardware nodes).
I have the FortiGate sending radius auth request to ISE which works correctly. The FortiGate then sends an accounting start message back to the ISE PSN's something like:
RADIUS Protocol
Code: Accounting-Request (4)
Packet identifier: 0x7f (127)
Length: 135
Authenticator: e64e88e1b0cadafb60171cbe309e2b30
Attribute Value Pairs
AVP: t=Acct-Status-Type(40) l=6 val=Start(1)
AVP: t=Event-Timestamp(55) l=6 val=Jul 16, 2025 14:19:38.000000000 AEST
AVP: t=Acct-Session-Id(44) l=18 val=00001e740050f041
AVP: t=User-Name(1) l=9 val=user
AVP: t=NAS-Identifier(32) l=12 val=nas
AVP: t=Framed-IP-Address(8) l=6 val=10.24.32.1
AVP: t=Vendor-Specific(26) l=12 vnd=Fortinet, Inc.(12356)
AVP: t=Vendor-Specific(26) l=12 vnd=Fortinet, Inc.(12356)
AVP: t=NAS-IP-Address(4) l=6 val=10.11.6.66
AVP: t=Called-Station-Id(30) l=12 val=10.11.6.66
AVP: t=Calling-Station-Id(31) l=16 val=125.168.63.113
my middleware is connected and subscribed to com.cisco.ise.session and com.cisco.ise.session.group
My problem is that when the session data arrives from the websocket it is missing the accounting session Id
{
"timestamp": "2025-07-16T15:44:25.245+10:00",
"state": "STARTED",
"userName": "user",
"callingStationId": "125.168.63.113",
"calledStationId": "10.11.6.66",
"ipAddresses": ["10.24.32.1"],
"nasIpAddress": "10.11.6.66",
"nasIdentifier": "nas",
"adNormalizedUser": "user",
"providers": ["None"],
"endpointCheckResult": "none",
"identitySourcePortStart": 0,
"identitySourcePortEnd": 0,
"identitySourcePortFirst": 0,
"networkDeviceProfileName": "Fortinet",
"mdmRegistered": false,
"mdmCompliant": false,
"mdmDiskEncrypted": false,
"mdmJailBroken": false,
"mdmPinLocked": false,
"selectedAuthzProfiles": ["PermitAccess"],
"useCase": "Proxy",
"ctsSecondarySecurityGroups": [],
"sxpDomains": [],
"inboundSgtDomainRules": [],
"workloadClassification": [],
"sessionSource": 0,
"vrf": "",
"destinationIPAddress": "10.254.254.52"
}
I need to map group membership from a local redis table and generate a new radius request to send to the fortigate RSSO listener. it would be a more stable and scalable solution of I could get the AVP: t=Acct-Session-Id(44) l=18 val=00001e740050f041 sent back to me through pxGrid as the middleware host does not see the RADIUS sent to ISE. Is it possible to enable this somewhere in ISE?
Thanks
Dale