Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 7 replies
  • Subscribers 28 subscribers
  • Views 5134 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Windows Server 2012 NPS, Radius SSO Accounting Messages

Oliver Rick

Hi

I've setup Radius authentication according to this KB: https://community.sophos.com/kb/en-us/127328

Wireless authentication works without any problems.

But i've also checked: "Accounting" and set the port to 1813

In my NPS I've setup a Radius Server Group and set : send accounting messages to <IP of Sophos XG>, port 1813. I've changed the Connection Policy to forward accounting messages to my Radius Server Group (Sophos XG). But my Sophos XG does not receive any accounting messages. I've installed wireshark on the server which is Running NPS. There is no traffic on port 1813 udp. 

What can i do to receive accounting messages?



This thread was automatically locked due to age.
  • 0

    First of all, your radius Server should send Accounting Information. 

    I do not know, which tool you are using.

    https://en.wikipedia.org/wiki/RADIUS

  • 0

    Hi,

    First of all i'll try to give you some more detailed information about my setup:

    I use Radius Enterprise Authentication for my Wireless Clients:

     

    Here are my Radius Settings:

    The Server IP is pointing to my Windows Active Directory Server. On that Server i've setup Network Policy and Access Services Role as descripted in the link above.

     

    My wireless users can now successfully authenticate them selfs with their Active Directory Username + Password if they connect the first time to the SSID. 

     

    But if i enable "Match known users" in my firewall rule. The Wireless Clients can't connect to the internet and i don't want them to use the captive portal because - in theory - they are already authenticated via Radius / WPA2 Enterprise. 

    In my understanding the checkbox "Enabled accounting" should work as a single sign on mechanism when somebody connects to the ssid?

     

    I've also added the Radius Server as a Firewall authentication method. 

     

    So my first question is:

    How can i do such a single sign on for my wireless clients, so that i can use "Match known users" in my firewall without a captive protal?

     

    Second question:

    Under "Services" i find "SSO using Radius accounting request". Is there something i need to configure too?

     

     

    My Access Points are Sophos AP100

  • +1 in reply to Oliver Rick

    The point is, we currently do not support Accounting with our Sophos APs.

    You can open a Sophos Support Case to get the current Status of this limitation.

  • 0 in reply to LuCar Toni

    With other Access Points accouting would be possible?

  • 0 in reply to Oliver Rick

    I think so. 

    Depends if the AP will send the correct Radius Information via Framed packet to XG or not. 

  • 0 in reply to LuCar Toni

    So:

    Using 3rd party components delivers more functionalaty than sophos own products? That's a little bit disappointing, don't you think?

    Thank you anyway for the clarification, i'll open a support case.

  • 0 in reply to Oliver Rick

    FYI : I've successfully used both Meraki and Ruckus AP's in conjunction with the XG Radius accounting feature. As mentioned the only requirement that I'm aware of is the framed address information is sent in the accounting packet - I don't think something like a Unfi AP will provide that information so it's not a given.

     

     Regards