Radius Challenge-Response issue with push token

Norbert_Bohusch — Fri, 27 Sep 2019 11:37:03 GMT

I am trying to get VPN Radius authentication working with Gemalto SAS/STA cloud solution where I have a push token in use. This means I have two ways of authenticating:

- I open the token on my mobile and enter the display code when asked by VPN client for challenge

- instead of entering the code into the VPN, I can enter "p" so a push to my mobile is sent and can be accepted there.

Both versions work fine if I use multiple login options and first option is username/password and second is Radius.

But if I only use Radius only first option is working (entering code manually). Other option is failing with "negotiation with site failed".

I did a capture on the gateway with tcpdump to look for Radius traffic and found out that if I only enter a "p", there is no traffic to the radius servers generated.

Has someone an idea who to cope with that?

I have tested this with R80.30 SmartCenter and following gateway versions:

- R80.30 JHF T50

- R80.10 JHF 169 + machine certificate authentication hotfix

Re: Radius Challenge-Response issue with push token

PhoneBoy — Fri, 27 Sep 2019 15:32:23 GMT

Sounds like a bug and you should probably open a TAC case.

topic Re: Radius Challenge-Response issue with push token in SASE and Remote Access

Radius Challenge-Response issue with push token

Re: Radius Challenge-Response issue with push token