Radius Authentication over SD-WAN

I would check where (which interface) the authentication packets leave the firewall.
(packetcapture with filter host=Radiusserver and port=radiusport)

Do you use IPsec RB-VPN for SD-WAN?

Can you show us your sd-wan-routing definition?

Its RED VPN (Firewall to Firewall) that the SD-WAN is configured over.

Its more fundamental than just radius server port, its the system-generated-traffic not being routed over the SD-WAN (as demonstrated above by adding static routing which then directs the traffic) 

Its RED VPN (Firewall to Firewall) that the SD-WAN is configured over.

Its more fundamental than just radius server port, its the system-generated-traffic not being routed over the SD-WAN (as demonstrated above by adding static routing which then directs the traffic) 

Your SD-WAN route configuration only contains the target network as a parameter? (no source, no service)

SD WAN is Local Network (x.x.x.0/24) and destination is Remote network (x.x.y.0/24)

Services are Any Service 

Works perfectly from anything local apart from the router, to anything remote including the remote router and vice versa, so both local and remote routers know that path for reply traffic, but cant process system-generated-traffic 

ok, but firewall-traffic has no defined "source".
Try with "destination" only. (like used in static routes too)

Thank you, that worked, it means that the firewall now has to control what traffic is allowed down the SD-WAN route rather than the route itself.

Suggestion for Sophos: for Source/Destination Networks, it would be useful to have a "System Generated" option, so it can be allowed over specific SD-WAN routes

IanR222 said:

Suggestion for Sophos: for Source/Destination Networks, it would be useful to have a "System Generated" option, so it can be allowed over specific SD-WAN routes

Great Idea!