topic Re: RADIUS not authenticating on new Expedition servers in Expedition Discussions

RADIUS not authenticating on new Expedition servers

a.banta02 — Fri, 10 Nov 2023 23:42:30 GMT

4x brand new VM and expedition installations. Configured RADIUS via GUI, configured user with external auth. Any attempts to log in with external auth result with an error "Failed: Incorrect user or password."

Attempts to test connection with RADIUS server return an error as well: "Server Connection Testing: Error: No reply received from the server [IP]:1812"

Apache logs show no references to any external authentication whatsoever. Monitoring connections from VM show no attempts to initiate any kind of connection whatsoever. RADIUS server shows no connection attempts from Expedition

php7.0-radius is installed. It appears as though the site is only attempting to use local auth and isnt configured for any kind of external auth. I can't find any documentation on where to find where this configuration is supposed to be.

Re: RADIUS not authenticating on new Expedition servers

sanandh — Mon, 13 Nov 2023 06:06:42 GMT

@a.banta02 - Can you share the version of expedition used?
Also, can you check with if there is connectivity available between Expedition and the Auth server. You can use something like netcat on Expedition CLI for this. Example: nc -uv <radius_ip> 1812

Re: RADIUS not authenticating on new Expedition servers

a.banta02 — Mon, 13 Nov 2023 21:07:35 GMT

v2.0, downloaded 11/10/23-ish.

Pings work fine, on same subnet. As mentioned previously, no communication leaves the expedition servers when attempting radius.

netcat returns nothing, just goes back to prompt. Attempting to telnet to <radius_ip> on port 1812 initiates connection, can be verified in another session with netstat showing appropriate info, SYN_SENT which is to be expected. This leads me to believe its not any kind of communication issue, the expedition server just isnt "attempting" to use radius - probably mis-configuration on the expedition server

Re: RADIUS not authenticating on new Expedition servers

sanandh — Tue, 14 Nov 2023 17:31:31 GMT

@a.banta02 - Please send an email to fwmigrate@paloaltonetworks.com to schedule a meeting to review the setup

Re: RADIUS not authenticating on new Expedition servers

a.banta02 — Tue, 14 Nov 2023 19:49:41 GMT

Turned out to be a RADIUS server misconfiguration. Once this was corrected it worked flawlessly.