topic Re: RADIUS Auth for Centrally Managed SMB Appliance not working. in SASE and Remote Access

RADIUS Auth for Centrally Managed SMB Appliance not working.

Kyle_S — Sun, 27 May 2018 15:23:52 GMT

RADIUS Auth for Centrally Managed SMB Appliance not working.

Scenario:

R80.10 JHF 103 Management Server

R77.20.75 SMB Appliance w/ Remote Access VPN and IPSec VPN Tunnels.

Problem:

Remote Access clients connect to GW1; RADIUS servers reside behind GW2 accessible via a Site to Site tunnel.

Partial Solution:

RADIUS/SecurID packets are being picked up by an implied rule instead of being encrypted

Updated the proper implied_rules.def file to not have RADIUS traffic picked up by an implied rule.

However, RADIUS traffic still is sourced from the External interface which isn't (And can't) be a member of the Encryption Domain for the Site to Site tunnel.

The following appears to be what I need to set, however, as the gateway is Centrally managed it's not an option:

How to force originating VPN connections from local gateway to use an internal interface IP instead of the external IP W…

Is something available in GuiDBEdit, Global Properties, or elsewhere that will allow me to set "VPN Site to Site global settings - Use internal IP address for encrypt" to force traffic from the internal interface of the Gateway?

Re: RADIUS Auth for Centrally Managed SMB Appliance not working.

G_W_Albrecht — Mon, 28 May 2018 11:07:48 GMT

Please consult sk116459 Traffic to RADIUS server from SMB appliance on Site to Site VPN, coming with source IP of WAN interface - you will find the solution for your firmware version with local nanagement in sk119415 How to force originating VPN connections from local gateway to use an internal interface IP instead of the external IP WAN/DMZ in SMB locally managed appliances - with central management, please either use the workaround config from sk116459 or follow sk25675 Customizing VPN Domain to exclude IP Address and allow clear text !

Re: RADIUS Auth for Centrally Managed SMB Appliance not working.

Kyle_S — Mon, 28 May 2018 13:06:52 GMT

I'm not sure how any of this is helpful.

SK116459 Pertains to Site to Site tunnels managed locally on the SMB Appliance. The VPN tab is not an option when the Gateway is manged centrally.

SK119415 Also pertains to a locally managed gateway, not a centrally managed gateway.

sk25675 Pertains to established traffic of the tunnel; and has nothing to do with re configuring the gateway to send RADIUS / LDAP / traffic from an internal interface instead of the External WAN interface.

None of your suggestions pertain to my issue.

Re: RADIUS Auth for Centrally Managed SMB Appliance not working.

G_W_Albrecht — Mon, 28 May 2018 14:01:18 GMT

SK116459 pertains to Site to Site tunnels managed locally on the SMB Appliance but contains a workaround for SMBs with older firmware (it is the good old No-NAT rule 😉 - and this workaround can be configured in Dashboard, too. And sk25675 gives the solution from sk119415 for centrally managed devices. So i do not see why you think that none of my suggestions pertain to youry issue.

Re: RADIUS Auth for Centrally Managed SMB Appliance not working.

Kyle_S — Mon, 28 May 2018 14:30:23 GMT

As there still seems to be confusion with the question I asked, and the SK's you have since provided not pertaining to the question that I asked, I opened a TAC case and received the following:

"We actually have a statement from our RnD regarding this that we don't have such a solution for centrally managed gateways. Currently, there is no plan for this solution for centrally managed gateways"

Re: RADIUS Auth for Centrally Managed SMB Appliance not working.

G_W_Albrecht — Mon, 28 May 2018 15:01:39 GMT

If the No-NAT rule does not work i would involve TAC.

Re: RADIUS Auth for Centrally Managed SMB Appliance not working.

Kyle_S — Tue, 29 May 2018 15:38:21 GMT

No-NAT has nothing to do with the gateway sourcing RADIUS / LDAP traffic from the External interface when Centrally manged. As I stated previously, a TAC case was opened, and RnD stated it was not supported nor was there any plans to support it in future releases.

Re: RADIUS Auth for Centrally Managed SMB Appliance not working.

Beja — Fri, 22 Mar 2019 17:16:14 GMT

Hi there.

what about this issue?

have we in the same stage? Surce IP is not able to force to internal interface?

Rergards.

Re: RADIUS Auth for Centrally Managed SMB Appliance not working.

PhoneBoy — Fri, 22 Mar 2019 18:57:34 GMT

If the SMB gateway is locally managed, you can apply the steps described here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk119415

If your SMB appliance is centrally managed, it is not currently supported, and you will need to file an RFE: https://www.checkpoint.com/rfe/rfe.htm

Re: RADIUS Auth for Centrally Managed SMB Appliance not working.

Beja — Fri, 22 Mar 2019 19:03:27 GMT

Done.
Feedback reference number: 20bNpMJ15

Re: RADIUS Auth for Centrally Managed SMB Appliance not working.

AttilaPeter — Thu, 13 Aug 2020 09:21:59 GMT

Hello Kyle_S

Does it resolved? If yes how?

In the sk119415 I seen a central management option which could be added later on and it seems only partly working.

Regards,

Attila

Re: RADIUS Auth for Centrally Managed SMB Appliance not working.

Schafi — Thu, 13 Aug 2020 14:41:17 GMT

Hi Attila,

I solved this kind of issue by adding a Hide-NAT Rule with the dynamic objects called "LocalMachine" as source and "LocalMachine_Internal_Interface" as translated source.

Best Regards
Jean-François

Re: RADIUS Auth for Centrally Managed SMB Appliance not working.

tspunkt — Tue, 26 Oct 2021 10:04:20 GMT

hey everybody,

i know its an old thread, but I run in the same problem with a RADIUS behind a site-to-site VPN community. I also tried the command written in SK119415 and i also tried the Hide-NAT rule without any effect on changing from external to interal IP address on a centrally managed 1590 smb (r80.20.35).

RADIUS traffic is accepted by an implied rule.

Are there any other fixes i can try without modifying the .def files?

Re: RADIUS Auth for Centrally Managed SMB Appliance not working.

PhoneBoy — Tue, 26 Oct 2021 14:55:16 GMT

Since the issue is with the implied rules, the only real way to address it is to edit the .def files.