Radius authentication not working

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Radius authentication not working

L2 Linker

We have configured Radius on our VM Palo but its not working. Provided screenshots of configuration we have on the FW and output of test command. Routing is defiantly in place as we can ping Radius server, however no traffic on 1812 reaching PacketFence Radius server. When done tcp dump - I can clearly see it's capturing pings but nothing for port 1812.

Palo Support not being helpful as for now just keep sending me unrelated articles... So hopefully get some advice here 🙂 

 

 

Target vsys is not specified, user '*******' is assumed to be configured with a shared auth profile.

 

Egress: x.x.208.14

Authentication to RADIUS server at x.x.65.40:1812 for user '*******'

Authentication type: PAP

Now send request to remote server ...

RADIUS error: bind: Cannot assign requested address

Authentication failed against RADIUS server at x.x.65.40:1812 for user '*********'

 

 

Authentication failed for user '****'



Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.
18 REPLIES 18

L7 Applicator

Monitor > Logs > System

Filter: ( subtype eq auth ) 

Do you see auth attempts in logs? What is in log description?

 

By default traffic sourced from Palo goes out from mgmt interface.

Assuming radius server IP is 1.2.3.4 does command "ping host 1.2.3.4" get replies?

Is Palo mgmt interface and radius server in same subnet or does this traffic traverse firewall?

If it traverses firewall do you see those sessions in traffic log?

 

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

ping is going through to radius - I have even add "source" in command to be sure is coming out of management interface.

We can see Auth logs as well but obviously not succesfull :

 

( description contains 'failed authentication for user \'*****\'. Reason: Authentication request is timed out. auth profile \'PF-Radius\', vsys \'shared\', server profile \'PF-Radius\', server address \'x.x.65.40\', auth protocol \'PAP\', From: x.x.x.x' )

 

 

L7 Applicator

If this traffic traverses firewall you can check Monitor > Logs > Traffic if those sessions are permitted, and if packets are sent and received.

You can also take packet capture https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/take-packet-captures/take-a-pac...

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Yep, we have checked monitor and no intersting traffic was there. Will try to setup capture to see it there. Just wondering if tcp dump from command line is sufficient an that was already done - we could see ping to radius server but nothing on 1812.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!