Radius Authentication Profile

[S.Byrne]

hello 

I am configuring a GP gateway for Radius Authentication 

I am using the CLI test authentication command to test 

I can ping the Radius host and confirmed Secret 

my troubleshooting shows packets allowed by the Security policy 

I cannot see any packets  to the Radius host in the packet captures in any of the stages

what do you think my next steps should be ?

[Raido_Rattameister]

RADIUS host and firewall mgmt interface are in same subnet?

To capture traffic going out from mgmt interface you need to take tcpdump in cli.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleECAS

Packet capture in web interface shows only traffic that passes Palo dataplane.

[S.Byrne]

first -thank you for your help 

Q can you check the configuration from the screenshots ?

I am trying to ensure my config flow is correct

1 define Radius server

2 define authentication profile 

3 use the authentication profile in the portal/gateway 

I can see the TLS connection/traffic  from my test client to the target VPN in the PA logs at the receive stage 

[S.Byrne]

Q for Radius authentication to work is it a pre-requisite that the management interface has full IP connectivity to the Radius server ?

[S.Byrne]

 there is an  existing working  GP portal configuration  that uses LDAP for authentication 

could this be an issue with the Security policy ?