Problem setting up WPA2-enterprise Wifi

Hello Christian,

you can 'tcpdump' the traffic between your XG and the NPS Server (XG/Advanced Shell):  

tcpdump -i any udp port 1812 -vv

With this tcpdump you see the RADIUS communication. To get better logs (in windows security log) you can use this command on NPS Server:

auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable

Regards,

Ben

Hi Ben,

tcpdump between my XG and NPS server:

09:18:15.417209 br01, IN: IP 172.16.0.80.41730 > 172.16.0.17.radius: RADIUS, Access-Request (1), id: 0x03 length: 218
09:18:15.417321 br01, OUT: IP 172.16.0.3.41730 > 172.16.0.17.radius: RADIUS, Access-Request (1), id: 0x03 length: 218
09:18:15.417323 Port3, OUT: IP 172.16.0.3.41730 > 172.16.0.17.radius: RADIUS, Access-Request (1), id: 0x03 length: 218
09:18:18.418533 br01, IN: IP 172.16.0.80.41730 > 172.16.0.17.radius: RADIUS, Access-Request (1), id: 0x03 length: 218
09:18:18.418568 br01, OUT: IP 172.16.0.3.41730 > 172.16.0.17.radius: RADIUS, Access-Request (1), id: 0x03 length: 218
09:18:18.418576 Port3, OUT: IP 172.16.0.3.41730 > 172.16.0.17.radius: RADIUS, Access-Request (1), id: 0x03 length: 218
09:19:43.492897 br01, IN: IP 172.16.0.80.41730 > 172.16.0.17.radius: RADIUS, Access-Request (1), id: 0x04 length: 218
09:19:43.493007 br01, OUT: IP 172.16.0.3.41730 > 172.16.0.17.radius: RADIUS, Access-Request (1), id: 0x04 length: 218
09:19:43.493009 Port3, OUT: IP 172.16.0.3.41730 > 172.16.0.17.radius: RADIUS, Access-Request (1), id: 0x04 length: 218
09:19:46.493881 br01, IN: IP 172.16.0.80.41730 > 172.16.0.17.radius: RADIUS, Access-Request (1), id: 0x04 length: 218
09:19:46.493891 br01, OUT: IP 172.16.0.3.41730 > 172.16.0.17.radius: RADIUS, Access-Request (1), id: 0x04 length: 218
09:19:46.493894 Port3, OUT: IP 172.16.0.3.41730 > 172.16.0.17.radius: RADIUS, Access-Request (1), id: 0x04 length: 218

172.16.0.80 is the access point, 172.16.0.3 is the XG firewall and 172.16.0.17 is the NPS server. We can see that Access-Request are sent to the NPS server.

But nothing more on the NPS side logs, even if detailed logs are enabled.

Check the wireshark dump on the NPS Server, if the firewall blocks it on the server itsefl

Hello Toni, unfortunately there's no firewall on the NPS server. We are checking what's happening with Wireshark.

Hi Toni, we've got this setting:

NPS 172.16.0.17-----------LAN 172.16.0.0/16------------ Port1 [XG in Bridged mode 172.16.0.3]Port3-------------- 172.16.0.1 Corporate router  --------- WAN

When testing radius with the button in XG interface, everything is OK, UDP 1812 packets flow through port 1 to the NPS server (checked with Wireshark).
When testing with a laptop, the XG tries to send the UDP packets through port 3, and nothing is received by the NPS server... Why is it acting like this ?

Can you show us your SD-WAN Config page in SFOS? 

Of course:

There is another wan access, not bridged through port2

What is your current routing priority. You see this on the top of this screen. 

Current priority routing is : SD-WAN, VPN routing, static

Try static - Sdwan VPN

Try static - Sdwan VPN

Caution If your route precedence specifies SD-WAN policy routes before static routes and you set Destination networks to Any, Sophos Firewall applies the policy route to all (external and internal) traffic, forcing your internal sources to use the WAN gateway for internal destinations.

This is likely to occur if you migrated from an earlier version to 18.0 or changed the default route precedence.

Ok, it does, migrated from 17.5

I'm going to move static first.

It's good, everything is working as expected, many thanks !