Radius on Gaia Embedded

[Bryce_Myers]

Does anyone here have Radius configured on their Gaia Embedded boxes?

I have it working fine from the CLI, but when someone tries to login to the WebUI it instantly returns "invalid username or password".  I am currently running R77.20.51 on these boxes.  I did a tcpdump and I see the radius traffic when a CLI attempt is made, but no radius traffic when an attempt is made from the WebUI.

I went through the Gaia Embedded documentation related to radius and I didn't see anything about this being a known limitation.

[PhoneBoy]

It appears that certain characters in the RADIUS shared secret are problematic for logging in via the WebUI.

This was an issue targeted to be resolved in the R77.20.60 release, which can be downloaded here: R77.20.60 for Small and Medium Business Appliances 

If this doesn't resolve the issue, I recommend opening a TAC case.

[Bryce_Myers]

Thanks Dameon -- I'm opening up a case with our engineers and I'll see if they have the same "fix".

[Bryce_Myers]

R77.20.60 fixed our Radius issues.

The issue wasn't with the shared secret, rather which characters the WebUI will accept vs the CLI.

Prior to R77.20.60 if you used certain special characters in the WebUI - it would instantly tell you bad username/password.

[Pedro_Espindola]

I have no problem with it. All I did was run this commands in clish:

set radius-server priority 1 ipv4-address X.X.X.X udp-port 1812 shared-secret <shared-secret> timeout 5
set administrators radius-auth enable use-radius-groups false permission read-write

Try to use a shared-secret with only letters and numbers for testing as Dameon suggested.

[Kurtis_Johnson]

Also note, there are advanced settings for modifying the RADIUS timeouts.  When using 2FA, you would be best to allow users more time to answer phone call/text or enter a TOTP code.