topic Re: RADIUS as a authentication factor for new clients in SASE and Remote Access

RADIUS as a authentication factor for new clients

Anton_Kazantsev — Tue, 21 Nov 2017 11:46:39 GMT

Trying to authenticate new cilents (E65 and above) or mobile access portal with RADIUS as authentication factor. Gateway sends in log "Failed to generate RADIUS auth request". Same setting for older vpn client works great.

Maybe its a known "fetature"?

Re: RADIUS as a authentication factor for new clients

PhoneBoy — Thu, 23 Nov 2017 00:04:57 GMT

My understanding is the actual RADIUS connection comes from the gateway not the client itself, with the client merely sending the request to the gateway.

I'd open a TAC case on this issue: Contact Support | Check Point Software

Re: RADIUS as a authentication factor for new clients

Hugo_vd_Kooij — Mon, 27 Nov 2017 08:39:06 GMT

Have toy defined the server as Radius version 1 or Radius version 2?

Re: RADIUS as a authentication factor for new clients

Anton_Kazantsev — Mon, 27 Nov 2017 09:37:38 GMT

I had two RADIUS servers. 1st - v2, 2nd - v1

Both sends "Failed to generate RADIUS auth request" in logs

Re: RADIUS as a authentication factor for new clients

Anton_Kazantsev — Thu, 30 Nov 2017 20:04:19 GMT

It seems I resolved this issue. Because SmartConsole does not enforce restrictions on names of Radius server object, I named it with spaces, but SmartDashboard said that spaces are prohibited and replaces it with underscore. After that I can authenticate with radius on new multi-login options.

I'll check it out more

Re: RADIUS as a authentication factor for new clients

AK2 — Wed, 25 Dec 2019 05:51:40 GMT

Found this very helpful thanks - got the same error and same solution - My Radius Server was called "Radius Primary" - renaming it to RadiusPrimary removed the error.

Re: RADIUS as a authentication factor for new clients

enapp — Thu, 27 Oct 2022 09:41:37 GMT

In my case my device is 1500 Locally Managed, the error message is the same but I am using Active Directory instead of RADIUS.

Checking the Security Log it reports Authentication Method: RADIUS.

Any advise?

Re: RADIUS as a authentication factor for new clients

Duane_Toler — Thu, 27 Oct 2022 13:57:37 GMT

Check your LDAP Account Unit object, "Authentication" tab. You might have either the Default template or the the default authentication set as RADIUS. You can also check the Default template user properties and its "Authentication" property.

Re: RADIUS as a authentication factor for new clients

enapp — Thu, 27 Oct 2022 14:27:25 GMT

Hi Duane,

It is working. I ended up removing the AD Group, disabling the Remote Access and reconfigured from the scratch. I changed also the Certificate Authentication to Manually choose a VPN certificate: Default VPN and and Cluster Certificate.