topic Re: Radius Auth VIA management? in GlobalProtect Discussions

Radius Auth VIA management?

tcsmithh — Tue, 06 Aug 2024 14:25:52 GMT

Greetings,

i have a GP portal and Gateway configured for radius auth in vr2 with just connected and a default route. vr1 has the routes to the radius server. my question is, can i send the auth requests via the management port?

thanks

Re: Radius Auth VIA management?

aleksandar.astardzhiev — Tue, 06 Aug 2024 19:39:08 GMT

Hi @tcsmithh,

By default Palo Alto firewall will always use the dedicated management interface for services like authentication servers, DNS, NTP etc.

When you configure your RADIUS server, firewall will try to reach it over the dedicated management interface. Note that this traffic does not pass over the firewall policy, nor perform route look with any VR (virtual-router), it just uses the management default route.

If FW management network does not have access to RADIUS server you can tell the firewall to use one of the dateplane interface, by changing the relevant service route - https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/service-routes/service-routes-overview

With service routes you basically tell the firewall which dataplane interface to use as source interface. After that the traffic will perform route lookup - against the VR associated with source interface - to determine the next hop.Traffic will also pass over the security policy, so if your policy is very restrictive you need to make sure it is allowed

Re: Radius Auth VIA management?

tcsmithh — Fri, 09 Aug 2024 14:16:35 GMT

thank you very much, i was certain that was the case, but wanted verification....unless i do custom routing.... thanks again

Re: Radius Auth VIA management?

aleksandar.astardzhiev — Fri, 09 Aug 2024 15:42:33 GMT

Hi @tcsmithh ,

In the service routes config you can specify source interface per service, or per destinantion.

If you define source interface for RADIUS service, this will force the firewall to use the same interface for every RADIUS server you define.

Specifying source interface per destination allow you to have different RADIUS servers reachable from different interfaces/VRs