This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

RADIUS authentication for WiFi suddenly stops working daily

Hello,

we have a XG125 in HQ and a XG86 in Branch Office (BO). Using latest firmware: SFOS 18.0.5 MR-5-Build586. Both are connected via a S2S SSL VPN (not IPSec). We are using RADIUS for WIFI authentication on all sites. RADIUS Servers are located in the HQ.

After booting the XG86 in th BO RADIUS authentication for the WIFI is working fine until a point in time, I think it is reconnect of Internet/ VPN in the night and then the XG86 does not reach the RADIUS Server anymore. Then also the authentication test in RADIUS Server configuration tab fails. Rebooting the XG86 solves the problem for the day... After reboot the authentication test is fine again and also the WIFI clients can authenticate via RADIUS.

How can we get rid of this issue?

Thank you!

This thread was automatically locked due to age.

Parents

0 LHerzog over 4 years ago

If you would have used IPSEC Tunnel, I'd have been sure, you need to enable SNAT and IPSec Routing. But I'm quite sure you still need SNAT.

Check this recent thread https://community.sophos.com/sophos-xg-firewall/f/discussions/128832/ipsec-traffic-uses-wrong-port and exclude the IPSEC stuff.

You need to check if your BO XG can reach the RADIUS on the HQ site and if not, check were it's sending the packets to - i guess, it does to the WAN interface instead of the tunnel.
Cancel
Vote Up 0 Vote Down

Cancel
0 bcw over 4 years ago in reply to LHerzog

Hello, I have set a SNAT rule, but did not solve the issue.

Btw. If the error occurs, I even can't ping the RADIUS server in HQ from the Sophos firewall. Clients can, so it is related to the firewall initiated traffic.

Packet capturing looks fine:

Traffic is going via the tun1 interface. 10.81.234.54 is the ssl vpn tunnel ip. 192.168.0.1 is the RADIUS Server.
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog over 4 years ago in reply to bcw

have you checked on the other side of the Tunnel - in HQ if the RADIUS there can reach the BO XG in the case the issue is happenig?

Maybe the back-path of the RADIUS packets is going a wrong way.

check tracert and also a tcpdump on the HQ XG.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 LHerzog over 4 years ago in reply to bcw

have you checked on the other side of the Tunnel - in HQ if the RADIUS there can reach the BO XG in the case the issue is happenig?

Maybe the back-path of the RADIUS packets is going a wrong way.

check tracert and also a tcpdump on the HQ XG.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data