RADIUS not authenticating on new Expedition servers

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

RADIUS not authenticating on new Expedition servers

L1 Bithead

4x brand new VM and expedition installations. Configured RADIUS via GUI, configured user with external auth. Any attempts to log in with external auth result with an error "Failed: Incorrect user or password."

 

Attempts to test connection with RADIUS server return an error as well: "Server Connection Testing: Error: No reply received from the server [IP]:1812"

 

Apache logs show no references to any external authentication whatsoever. Monitoring connections from VM show no attempts to initiate any kind of connection whatsoever. RADIUS server shows no connection attempts from Expedition

 

php7.0-radius is installed. It appears as though the site is only attempting to use local auth and isnt configured for any kind of external auth. I can't find any documentation on where to find where this configuration is supposed to be.

1 accepted solution

Accepted Solutions

@a.banta02 - Please send an email to fwmigrate@paloaltonetworks.com to schedule a meeting to review the setup

View solution in original post

4 REPLIES 4

L2 Linker

@a.banta02 - Can you share the version of expedition used?
Also, can you check with if there is connectivity available between Expedition and the Auth server. You can use something like netcat on Expedition CLI for this. Example: nc -uv <radius_ip> 1812

v2.0, downloaded 11/10/23-ish.

Pings work fine, on same subnet. As mentioned previously, no communication leaves the expedition servers when attempting radius.

 

netcat returns nothing, just goes back to prompt. Attempting to telnet to <radius_ip> on port 1812 initiates connection, can be verified in another session with netstat showing appropriate info, SYN_SENT which is to be expected. This leads me to believe its not any kind of communication issue, the expedition server just isnt "attempting" to use radius - probably mis-configuration on the expedition server

@a.banta02 - Please send an email to fwmigrate@paloaltonetworks.com to schedule a meeting to review the setup

Turned out to be a RADIUS server misconfiguration. Once this was corrected it worked flawlessly.

  • 1 accepted solution
  • 774 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!