Radius Authentication over SD-WAN

Hello,

Could you add static route for the remote end Radius server and validate once?

Hello,

It seems like you scenario hitting one of the condition mentioned in KBA:

support.sophos.com/.../KBA-000007806

Hi Mayur Makvana,

which condition exactly do you mean?

I have been through that list, and I am not sure which scenario I would be hitting in that KBA as I am not running any enabled proxy within SF-FW, or am I miss understanding the proxy term there?

The requirement for "One WAN interface (default gateway) or static route is necessary for PBR to work for system-originating traffic" is met as I have one WAN interface with the default gateway.

As suggested I have tried a static route, and I can then ping from whichever end has a static route enabled, and the radius authentication then passes its tests.

Thanks

Ian 

Hello IanR222 ,

Thank you for the update. I suggest using the static route for now. 

To understand it further, which scenario is hitting. We may need your network diagram with the connectivity details along with the packet captures to identify which condition is being hit from the above mentioned KBA.

You seems to have pointed the correct option, however, I suspect any of below seems to be the case in your scenario

1: One WAN interface (default gateway) or static route is necessary for PBR to work for system-originating traffic. You need the WAN interface (default gateway) or static route for proxy traffic match in the reply path

OR 

2: The SD-WAN policy route (policy-based route) that has higher precedence than the VPN policy route based on the route_precedence configuration will be disregarded by system-originating traffic if a match with the latter policy is made. Sophos Firewall will not follow the route precedence in such a scenario. However, if the system-originating traffic matches a static route, it will apply the route precedence configuration between the static and VPN routes or between static and SD-WAN policy routes.

Also, like dirkkotte mentioned, select source as any in SDWAN route and help us with the output.

Hello IanR222 ,

Thank you for the update. I suggest using the static route for now. 

To understand it further, which scenario is hitting. We may need your network diagram with the connectivity details along with the packet captures to identify which condition is being hit from the above mentioned KBA.

You seems to have pointed the correct option, however, I suspect any of below seems to be the case in your scenario

1: One WAN interface (default gateway) or static route is necessary for PBR to work for system-originating traffic. You need the WAN interface (default gateway) or static route for proxy traffic match in the reply path

OR 

2: The SD-WAN policy route (policy-based route) that has higher precedence than the VPN policy route based on the route_precedence configuration will be disregarded by system-originating traffic if a match with the latter policy is made. Sophos Firewall will not follow the route precedence in such a scenario. However, if the system-originating traffic matches a static route, it will apply the route precedence configuration between the static and VPN routes or between static and SD-WAN policy routes.

Also, like dirkkotte mentioned, select source as any in SDWAN route and help us with the output.