Authentification RADIUS UDP PORT UNREACHABLE

[redouane143164]

Hello, I am currently experiencing an issue with my firewall during RADIUS authentication against a ClearPass server running on Linux; when I try to initiate a connection using an account, I get an "UDP port unreachable" message. Could you tell me how to resolve this problem?

[simonemantovani]

Hello

It seems that the Radius port on the Radius server is not listening; did you check on Radius server if everything is ok and also if the IP of your firewall (172.28.242.182) is configured as a radius client?

[redouane143164]

Hello,

Yes, the client has indeed registered my firewall as a client on their RADIUS server, but with every repeated authentication attempt, I only see Access-Request packets in the tcpdump—never a response from the RADIUS server to my firewall.

[simonemantovani]

Ok, if there is no other device between your firewall and the Radius server that could drop traffic, I suggest to check directly on your Radius server any available log, and in case (if possible) you could try to perform a packet capture on the radius server (using wireshark if it's a windows machine or tcpdump if it's linux) and check if you receive the Access-requests from the firewall and if the radius server is replying to these requests.

It sounds that the Radius Server is not answering to the requests performed by the firewall but let see if you find anything on server side.

[redouane143164]

There is a router performing dynamic eBGP routing between the firewall and the RADIUS server; I suspect the traffic is getting blocked at this device because it never reaches the RADIUS server—no logs appear on the server. Furthermore, I am encountering a similar issue with an IPsec VPN between two clusters I set up for my client; in that case, too, I never receive a response.

[simonemantovani]

Ok, you should investigate if the router is the reason why Radius Server doesn't receive Access-Request packets.