RADIUS not authenticating on new Expedition servers

[a.banta02]

4x brand new VM and expedition installations. Configured RADIUS via GUI, configured user with external auth. Any attempts to log in with external auth result with an error "Failed: Incorrect user or password."

Attempts to test connection with RADIUS server return an error as well: "Server Connection Testing: Error: No reply received from the server [IP]:1812"

Apache logs show no references to any external authentication whatsoever. Monitoring connections from VM show no attempts to initiate any kind of connection whatsoever. RADIUS server shows no connection attempts from Expedition

php7.0-radius is installed. It appears as though the site is only attempting to use local auth and isnt configured for any kind of external auth. I can't find any documentation on where to find where this configuration is supposed to be.

[sanandh]

@a.banta02 - Can you share the version of expedition used?
Also, can you check with if there is connectivity available between Expedition and the Auth server. You can use something like netcat on Expedition CLI for this. Example: nc -uv <radius_ip> 1812

[a.banta02]

v2.0, downloaded 11/10/23-ish.

Pings work fine, on same subnet. As mentioned previously, no communication leaves the expedition servers when attempting radius.

netcat returns nothing, just goes back to prompt. Attempting to telnet to <radius_ip> on port 1812 initiates connection, can be verified in another session with netstat showing appropriate info, SYN_SENT which is to be expected. This leads me to believe its not any kind of communication issue, the expedition server just isnt "attempting" to use radius - probably mis-configuration on the expedition server

[sanandh · Accepted solution]

@a.banta02 - Please send an email to fwmigrate@paloaltonetworks.com to schedule a meeting to review the setup

[a.banta02]

Turned out to be a RADIUS server misconfiguration. Once this was corrected it worked flawlessly.