topic Re: RADIUS accounting not sent in SASE and Remote Access

RADIUS accounting not sent

petermatuska — Mon, 31 Aug 2020 14:28:08 GMT

Hi,

I use ISE radius server for authentication for VPN users. I setup radius accounting in Identity awareness tab of the gateway. When I do the wireshark I cant see any accounting messages sent from check point to ise. Is it normal behaviour or bug?

thank you

Re: RADIUS accounting not sent

Chris_Atkinson — Tue, 01 Sep 2020 14:52:58 GMT

The use case for Radius Accounting here is reversed.

Cisco would send Acct to CP and we would read user ID mappings from these records.

Re: RADIUS accounting not sent

John_Fleming — Tue, 01 Sep 2020 16:40:04 GMT

I don't think that is correct. I don't think there is any flow that starts with a radius server communicating with the client (checkpoint). Also what you're describing sounds more like authentication reply traffic and not accounting.

Re: RADIUS accounting not sent

John_Fleming — Tue, 01 Sep 2020 16:54:40 GMT

I don't think checkpoint generates accounting packets vpn sessions.

Phoneboy said this

Re: RADIUS accounting not sent

Chris_Atkinson — Tue, 01 Sep 2020 23:46:18 GMT

In the context of Identity awareness this is how it works but this is not what the OP is trying to achieve.

Re: RADIUS accounting not sent

PhoneBoy — Wed, 02 Sep 2020 04:42:12 GMT

What you're setting up in the Identity Awareness tab of the gateway is what identity sources are being consumed.
We do consume RADIUS Accounting messages from other sources, but do not send them.