pxGrid session subscription missing radius accounting session Id

d.blakemore · ‎07-16-2025

Hi

I'm building a custom middleware connector between FrotiOS 7.6 firewall and AIS as the native FortiNet connector does not work correctly for a multi node ISE deployment (we have 10 hardware nodes).

I have the FortiGate sending radius auth request to ISE which works correctly. The FortiGate then sends an accounting start message back to the ISE PSN's something like:

RADIUS Protocol
Code: Accounting-Request (4)
Packet identifier: 0x7f (127)
Length: 135
Authenticator: e64e88e1b0cadafb60171cbe309e2b30
Attribute Value Pairs
AVP: t=Acct-Status-Type(40) l=6 val=Start(1)
AVP: t=Event-Timestamp(55) l=6 val=Jul 16, 2025 14:19:38.000000000 AEST
AVP: t=Acct-Session-Id(44) l=18 val=00001e740050f041
AVP: t=User-Name(1) l=9 val=user
AVP: t=NAS-Identifier(32) l=12 val=nas
AVP: t=Framed-IP-Address(8) l=6 val=10.24.32.1
AVP: t=Vendor-Specific(26) l=12 vnd=Fortinet, Inc.(12356)
AVP: t=Vendor-Specific(26) l=12 vnd=Fortinet, Inc.(12356)
AVP: t=NAS-IP-Address(4) l=6 val=10.11.6.66
AVP: t=Called-Station-Id(30) l=12 val=10.11.6.66
AVP: t=Calling-Station-Id(31) l=16 val=125.168.63.113

my middleware is connected and subscribed to com.cisco.ise.session and com.cisco.ise.session.group

My problem is that when the session data arrives from the websocket it is missing the accounting session Id

  {
    "timestamp": "2025-07-16T15:44:25.245+10:00",
    "state": "STARTED",
    "userName": "user",
    "callingStationId": "125.168.63.113",
    "calledStationId": "10.11.6.66",
    "ipAddresses": ["10.24.32.1"],
    "nasIpAddress": "10.11.6.66",
    "nasIdentifier": "nas",
    "adNormalizedUser": "user",
    "providers": ["None"],
    "endpointCheckResult": "none",
    "identitySourcePortStart": 0,
    "identitySourcePortEnd": 0,
    "identitySourcePortFirst": 0,
    "networkDeviceProfileName": "Fortinet",
    "mdmRegistered": false,
    "mdmCompliant": false,
    "mdmDiskEncrypted": false,
    "mdmJailBroken": false,
    "mdmPinLocked": false,
    "selectedAuthzProfiles": ["PermitAccess"],
    "useCase": "Proxy",
    "ctsSecondarySecurityGroups": [],
    "sxpDomains": [],
    "inboundSgtDomainRules": [],
    "workloadClassification": [],
    "sessionSource": 0,
    "vrf": "",
    "destinationIPAddress": "10.254.254.52"
  }

I need to map group membership from a local redis table and generate a new radius request to send to the fortigate RSSO listener. it would be a more stable and scalable solution of I could get the AVP: t=Acct-Session-Id(44) l=18 val=00001e740050f041 sent back to me through pxGrid as the middleware host does not see the RADIUS sent to ISE. Is it possible to enable this somewhere in ISE?

Thanks
Dale