Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 9 replies
  • Subscribers 40 subscribers
  • Views 1770 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Wi-Fi -RADIUS authentication doesn't failover to the secondary server

David Wroten

Hey All,

I'm having a peculiar issue where Sophos XG fails to detect the primary RADIUS server is offline and finally failover to the secondary server for wireless authentication.

Configuration

  • XG135 (SFOS 17.5.7 MR-7.HF062020.1)
  • RAD-1 - Server 2016 (Member Server, NPS) - Running on ESXI (On-Site)
  • RAD-2 - Server 2016 (Member Server, NPS) - Running in Azure
  • Client Machine (Windows 10 Pro)

With either server individually set as the primary RADIUS authentication server, I can connect to the Wi-Fi network with a client machine no problem at all.

Testing Failover

To simulate a failure of the premise RAD-1 server, I went into ESXI and proceeded to suspended the machine and then attempted to connect to the Wi-Fi using the same client machine. The behavior observed on the client machine is I continue to receive "Can't connect to this network".

Multiple attempts yield the same result even after 10 to 15 minutes.

If I manually set the RAD-2 as the primary while the RAD-1 system is still suspended, the client machine is able to connect as expected.

I've been playing around with this for a while now and am not sure what's going on here. Packet captures show Sophos sending out ARP-NDP requests to the RAD-1 IP address but never receives a response which is expected.

This issue has been observed on both this XG135 and a XG310 I deployed at another site with a similar configuration for Wi-Fi.

Any ideas on what might be going on here?



This thread was automatically locked due to age.
Parents
  • 0

    Just to be sure, XG sending the traffic but not getting a response? As far as i know, the service will be monitored via TCP (Port). So if the Port is still reachable, it considers the service as alive. 

    If you block the Radius protocol on the windows server to prevent the communication, does it failover? 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    So doing some more testing today. When I suspend the premise VM I can see Sophos continues to send UDP packets to the endpoint. I have 3 pages worth of packets using filter "port 1812" to that host. I do not see any requests at all to the secondary server using this filter.

    Following what LuCar Toni mentioned. I tried leaving the VM online and blocked the RADIUS port (1812) using Window's firewall but the same behavior persist.

Reply
  • 0 in reply to LuCar Toni

    So doing some more testing today. When I suspend the premise VM I can see Sophos continues to send UDP packets to the endpoint. I have 3 pages worth of packets using filter "port 1812" to that host. I do not see any requests at all to the secondary server using this filter.

    Following what LuCar Toni mentioned. I tried leaving the VM online and blocked the RADIUS port (1812) using Window's firewall but the same behavior persist.

Children
Unfiltered HTML