Issues with CP RADIUS using Duo Auth after installing MS KB5040430 or KB5040434

[Heath]

This is an issue we are trying to cover all products in the chain and I wanted to reach out to the community to see if there was anyone else experiencing the issue as we have.

The issue seen is that we run Windows updates, as we normally do, but when we run these updates in the subject on a Windows server running the Duo Authentication Proxy we then start seeing issues with Check Point RADIUS authentications. In the CP logs we get the message of RADIUS server not found.

So we have auth failures with CP Mobile Access VPNs setup to use Duo as well as CP Management access setup to auth through RADIUS/Duo.

I wasn't going to reach out here, but we have an external VPN running Cisco Secure Client and AnyConnect that does not have an issue at all with these updates and function as it should. The only issues currently seems to be with CP.

Is anyone else with this combo of CP/Duo/Windows having these same issues? Thanks!

[Lesley]

I would put my money on this SK:https://support.checkpoint.com/results/sk/sk42184

Would also recommend to cpstop;cpstart the relevant system after all steps taken. 

[Heath]

That does look promising. We'll set it up in the lab tomorrow. Thanks!

[the_rock]

I had  3 customers try that sk before and sadly did not help.

Andy

[the_rock]

100% it has to do with windows update and pretty much for now, thats the best option to fix it, uninstall the updates.

Andy

[Heath]

That's what we've been doing but I'm not holding out on MS fixing it anytime soon. We haven't found anything on this from any front yet. Thanks for the reply!

[the_rock]

Personally, considering they cant fix January windows 10 update thats broken, no offense, it highly unlikely they will fix this any time soon lol

Andy

[Heath]

Agreed. Just kinda sad that the only issue we are seeing is tied to CP.

[the_rock]

I hear ya...lets hope it all goes back to normal soon.

Andy

[PhoneBoy]

I suspect this is related to the fixes needed to mitigate BLAST RADIUS: https://support.checkpoint.com/results/sk/sk182516
A possible workaround for this would be to implement: https://support.checkpoint.com/results/sk/sk42184 
Fixes for this have not yet been rolled into the JHF.
Best to consult with TAC here.