Radius Auth VIA management?

[tcsmithh]

Greetings,

i have a GP portal and Gateway configured for radius auth in vr2 with just connected and a default route. vr1 has the routes to the radius server. my question is, can i send the auth requests via the management port?

thanks

[aleksandar.astardzhiev · Accepted solution]

Hi @tcsmithh,

By default Palo Alto firewall will always use the dedicated management interface for services like authentication servers, DNS, NTP etc.

When you configure your RADIUS server, firewall will try to reach it over the dedicated management interface. Note that this traffic does not pass over the firewall policy, nor perform route look with any VR (virtual-router), it just uses the management default route.

If FW management network does not have access to RADIUS server you can tell the firewall to use one of the dateplane interface, by changing the relevant service route - https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/service-routes/service-routes-...

With service routes you basically tell the firewall which dataplane interface to use as source interface. After that the traffic will perform route lookup - against the VR associated with source interface - to determine the next hop.Traffic will also pass over the security policy, so if your policy is very restrictive you need to make sure it is allowed

[tcsmithh]

thank you very much, i was certain that was the case, but wanted verification....unless i do custom routing.... thanks again

[aleksandar.astardzhiev]

Hi @tcsmithh ,

In the service routes config you can specify source interface per service, or per destinantion.

If you define source interface for RADIUS service, this will force the firewall to use the same interface for every RADIUS server you define.

Specifying source interface per destination allow you to have different RADIUS servers reachable from different interfaces/VRs