topic Re: Problem with traffic from standby member to radius in Firewall & Security Management

Problem with traffic from standby member to radius

nooni — Thu, 06 Oct 2022 11:36:09 GMT

We are having some issues with radius authentication from standby member in a cluster that

consists of two open server nodes (vmware virtual machines) running R80.40.

Both nodes have radius server authentication configured but it is only possible to login to the active node.

If we switch roles from active to standby the other node that becomes active works.

We have traced traffic and traffic goes from Standby node over via Active node to Radius server.

Radius server is responding back to cluster IP and is visible on Active node but then no return traffic is visible on the standby.

The following steps have been made in attempts to correct the issue:

In VMWARE, disable Forged Mac Address on Sync portgroup

We have tried to toggle these Kernel parameters:

fwha_cluster_hide_active_only

fwha_silent_standby_mode

fwha_forw_packet_to_not_active

But no difference at all, no reboot was made just toggle the flags on the fly.

Any suggestions on how to further check this issue are welcome 🙂

Thanks

//Rickard

Re: Problem with traffic from standby member to radius

Sorin_Gogean — Thu, 06 Oct 2022 11:56:04 GMT

hey,

we're also using Radius (Cisco ISE) to authenticate/authorize access on the appliance.
as I know we don't have any issue, as we have the appliances registered in ISE by LAN IP and Management IP address .

also I see you have them as virtual machines, our virtual ones are single appliances, so no HA there and no Radius problem also .

when you try to perform an Radius authentication on the secondary box, can you also have an SSH session (in expert mode maybe) and do a TCPDUMP on LAN/Management towards Radius IP and see what you get there.

I would say it's normal to see traffic in the ACTIVE box, as you would route through that one towards RADIUS Server - not sure on your set-up.

ty,

Re: Problem with traffic from standby member to radius

nooni — Thu, 06 Oct 2022 12:25:21 GMT

Hi,

Yes as far as i understand the traffic flow is as expected.

But the problem is that return traffic does not seem to reach the standby.

If we listen for traffic at Radius we see traffic from Active node with cluster IP as source and return.

Re: Problem with traffic from standby member to radius

Sorin_Gogean — Thu, 06 Oct 2022 14:17:25 GMT

"If we listen for traffic at Radius we see traffic from Active node with cluster IP as source and return." - sorry but you have smth WRONG there.
if I ask RADIUS AUTH from standby, then the RADIUS server should see the packet coming from the standby appliance (IP address).

several details are missing, as you should not route standby traffic over ACTIVE GW, unless you have some weird routing/set-up and some NAT in place - that would explain you seeing Active Node IP on an Secondary Node return.

so can you sketch smth in paint - how are things connected and what communicates with what ?

ty,

Re: Problem with traffic from standby member to radius

Chris_Atkinson — Thu, 06 Oct 2022 14:43:59 GMT

What network/interface is the Radius server located on/via relative to the firewall?

When configuring the above kernel parameters did you also adjust your NAT policy to compensate?

For the Radius configuration what "NAS IP Address" value is set and what is ISE configured to allow?

Re: Problem with traffic from standby member to radius

PhoneBoy — Thu, 06 Oct 2022 16:21:03 GMT

What JHF are you on?
I'd ensure you're on at least the latest GA JHF.
See: https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/R80.40/R80.40_Downloads.htm?tocpath=_____3