Using two different Radius at the same time?

[rps]

In service route configuration one can define which interface should be used by the managementplane to reach the Radius server which you will use.

However Radius can be used both for admin-logins aswell as captive portal (user-logins).

Is it possible to setup one Radius to be used for admin-logins (towards the PA unit) and another Radius to be used to authenticate users in captive portal before they can do web-browsing?

[rps]

I forgot...

The Radius used for admin-logs will only be accessible through MGT interface while Radius used for captive portal will be accessed through any of the other ethernet-interfaces on the dataplane.

[swhyte]

I assume that your next post has already answered this question.

[swhyte]

I assume that this post is the answer to your previous question.

[rps]

Based on your answer I guess its not possible to use one Radius for adminlogs (towards MGT) and another Radius for userlogins (towards captive portal)?

I guess I'll have to issue yet another request...

Another request would be if PaloAlto Networks could issue requests on their own based on the discussions in KnowledgePoint without having to force their customers to issue a specific request towards their support.

[James]

If you click on "show destinations" in the service route configuration - you can put in there the IP address of the 2nd RADIUS server and the alternative L3 interface you wish to use.

Hope this helps

[rps]

But that would render that users can login to MGT interface just because they exists in the userradius and not in the adminradius.

It would be nice if those two things could be separate (since the dataplane and controlplane is already (somewhat) separate in a PAN).

[mjacobsen]

I think we need to back a few steps. The RADIUS server for admin authentication is independent of the RADIUS server for captive portal authentication. Assuming those two IP addresses are different, you can do as James suggested and route the requests out specific interfaces via the Service Route Configuration.

Mike

[rps]

Ahh ok so selecting radius in service route configuration is the global setting for the PAN where to (or rather which source interface should be used) send radius requests and if I do that I will also have to add a "static" route in the service route configuration towards the ip for the userradius used by the captive portal (assuming that the "radius" setting in service route will be set to use MGT interface) and then everything should be fine? 🙂

Are there any differences when sending "administrative" traffic through one of the dataplane interfaces compared to the dedicated mgt-interface?

Im thinking of if the fpga will cut the sessions due to some timeout which might exist on stuff that passes through dataplane but it will not be cut when using mgt-interface?