topic Re: Radius on Gaia Embedded in Spark Firewall (SMB)

Radius on Gaia Embedded

Bryce_Myers — Mon, 14 Aug 2017 18:03:11 GMT

Does anyone here have Radius configured on their Gaia Embedded boxes?

I have it working fine from the CLI, but when someone tries to login to the WebUI it instantly returns "invalid username or password". I am currently running R77.20.51 on these boxes. I did a tcpdump and I see the radius traffic when a CLI attempt is made, but no radius traffic when an attempt is made from the WebUI.

I went through the Gaia Embedded documentation related to radius and I didn't see anything about this being a known limitation.

Re: Radius on Gaia Embedded

PhoneBoy — Mon, 14 Aug 2017 18:51:53 GMT

It appears that certain characters in the RADIUS shared secret are problematic for logging in via the WebUI.

This was an issue targeted to be resolved in the R77.20.60 release, which can be downloaded here: R77.20.60 for Small and Medium Business Appliances

If this doesn't resolve the issue, I recommend opening a TAC case.

Re: Radius on Gaia Embedded

Bryce_Myers — Mon, 14 Aug 2017 19:16:08 GMT

Thanks Dameon -- I'm opening up a case with our engineers and I'll see if they have the same "fix".

Re: Radius on Gaia Embedded

Pedro_Espindola — Mon, 14 Aug 2017 19:59:31 GMT

I have no problem with it. All I did was run this commands in clish:

set radius-server priority 1 ipv4-address X.X.X.X udp-port 1812 shared-secret <shared-secret> timeout 5
set administrators radius-auth enable use-radius-groups false permission read-write

Try to use a shared-secret with only letters and numbers for testing as Dameon suggested.

Re: Radius on Gaia Embedded

Kurtis_Johnson — Mon, 11 Sep 2017 17:05:15 GMT

Also note, there are advanced settings for modifying the RADIUS timeouts. When using 2FA, you would be best to allow users more time to answer phone call/text or enter a TOTP code.

Re: Radius on Gaia Embedded

Bryce_Myers — Thu, 30 Nov 2017 19:10:09 GMT

R77.20.60 fixed our Radius issues.

The issue wasn't with the shared secret, rather which characters the WebUI will accept vs the CLI.

Prior to R77.20.60 if you used certain special characters in the WebUI - it would instantly tell you bad username/password.