Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 9 replies
  • Subscribers 40 subscribers
  • Views 1771 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Wi-Fi -RADIUS authentication doesn't failover to the secondary server

David Wroten

Hey All,

I'm having a peculiar issue where Sophos XG fails to detect the primary RADIUS server is offline and finally failover to the secondary server for wireless authentication.

Configuration

  • XG135 (SFOS 17.5.7 MR-7.HF062020.1)
  • RAD-1 - Server 2016 (Member Server, NPS) - Running on ESXI (On-Site)
  • RAD-2 - Server 2016 (Member Server, NPS) - Running in Azure
  • Client Machine (Windows 10 Pro)

With either server individually set as the primary RADIUS authentication server, I can connect to the Wi-Fi network with a client machine no problem at all.

Testing Failover

To simulate a failure of the premise RAD-1 server, I went into ESXI and proceeded to suspended the machine and then attempted to connect to the Wi-Fi using the same client machine. The behavior observed on the client machine is I continue to receive "Can't connect to this network".

Multiple attempts yield the same result even after 10 to 15 minutes.

If I manually set the RAD-2 as the primary while the RAD-1 system is still suspended, the client machine is able to connect as expected.

I've been playing around with this for a while now and am not sure what's going on here. Packet captures show Sophos sending out ARP-NDP requests to the RAD-1 IP address but never receives a response which is expected.

This issue has been observed on both this XG135 and a XG310 I deployed at another site with a similar configuration for Wi-Fi.

Any ideas on what might be going on here?



This thread was automatically locked due to age.
Parents
  • 0

    Just to be sure, XG sending the traffic but not getting a response? As far as i know, the service will be monitored via TCP (Port). So if the Port is still reachable, it considers the service as alive. 

    If you block the Radius protocol on the windows server to prevent the communication, does it failover? 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    he suspended the on premise VM. So there should'nt be a response to anything connecting.

    The solution here is  interesting for me too as we currently only have a single RADIUS machine configured on the XG and a second one is desired. If you now find that a failover never happens, we would not need to invest time in a second machine.

Reply
  • 0 in reply to LuCar Toni

    he suspended the on premise VM. So there should'nt be a response to anything connecting.

    The solution here is  interesting for me too as we currently only have a single RADIUS machine configured on the XG and a second one is desired. If you now find that a failover never happens, we would not need to invest time in a second machine.

Children
No Data
Unfiltered HTML