topic Re: potential issue with RADIUS traffic passed through Palo devices in Next-Generation Firewall Discussions

potential issue with RADIUS traffic passed through Palo devices

BPSoftware — Wed, 18 Sep 2024 04:38:54 GMT

Hi all,

There is a good chance this is not in fact a firewall issue at all.

But I just wanted to ask people who have more experience than me.

Has anyone experienced an issue where despite RADIUS traffic being passed through a Palo appliance successfully, RADIUS authentication has still failed?

The scenario I describe is from Meraki AP's to a windows NPS server on another network. I suspect the issue is with the RADIUS configuration, but just wanted to check.

Thank you.

Re: potential issue with RADIUS traffic passed through Palo devices

reaper — Wed, 18 Sep 2024 07:49:53 GMT

is this a consistent issue or does it happen randomly?

you could set up packet-diag filters and packetcapture between 2 hosts for radius connections (bidirectional) to see if anything weird is popping up in the global counters, or any packets are getting moved around by the firewall between ingress and egress

Re: potential issue with RADIUS traffic passed through Palo devices

OtakarKlier — Wed, 18 Sep 2024 18:27:32 GMT

Hello,

I have several types of radius setup flowing through a Palo Alto, no issues, If you think there is an issue, as Reaper mentioned perform a pcap and look at the traffic logs to see if anything was denied. The Palo Alto does not 'change or modify' the packets.

Regards,

Re: potential issue with RADIUS traffic passed through Palo devices

BPSoftware — Thu, 19 Sep 2024 00:09:26 GMT

Hi everyone, thank you for the replies its much appreciated.

We have narrowed the issue down to my old nemesis MTU size. Correct me if I'm wrong but Palo Alto firewalls like most devices, use 1500 by default, right? I've never specified one previously. Seems like they are fragmenting anything over 1000. Very odd.

Re: potential issue with RADIUS traffic passed through Palo devices

Pieter-Janssens — Tue, 11 Feb 2025 09:30:47 GMT

I was wondering how u overcome this issue.

Have the same problem with a remote site that needs to access the radius server over Site to site VPN.

No radius traffic seen on Palo alto at the remote site.

Checked this article

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClLPCA0

and almost sure that Palo Alto (440) drops the packets due MTU size.