topic Re: Radius Timeout Issues - remote site in Wireless

Radius Timeout Issues - remote site

Shewie — Wed, 11 Oct 2023 11:28:21 GMT

Currently trying to setup a wireless network on the other side of the planet, we're experiencing Radius server timeouts on client authentication, latency is around 133-137ms back to the Radius server. Tried increasing the radius server timemout from 1s to 10s but no change.

Is there anything else we can try other than a local PSK

Re: Radius Timeout Issues - remote site

aleabrahao — Wed, 11 Oct 2023 11:34:05 GMT

Is this communication via the Internet or S2S VPN?

Re: Radius Timeout Issues - remote site

Shewie — Wed, 11 Oct 2023 11:35:48 GMT

It's over a Palo Alto S2S VPN, we can see the requests reaching our Radius server but nothing gets back

Re: Radius Timeout Issues - remote site

aleabrahao — Wed, 11 Oct 2023 11:38:40 GMT

Strange, did you ever do a packet capture in Palo Alto?

Are the Proxy ID on the tunnel and routes on the VR configured correctly?

Re: Radius Timeout Issues - remote site

aleabrahao — Wed, 11 Oct 2023 11:42:11 GMT

Another thing, I don't know which Radius you are using (NPS, Freeradius), but did you add the AP IP with the Radius Client?

Re: Radius Timeout Issues - remote site

Philip D'Ath — Wed, 11 Oct 2023 20:09:21 GMT

> latency is around 133-137ms back to the Radius server.

This is not your issue.

What I have seen is RADIUS packets failing when an MTU squeeze happens (such as when using VPN). Try reducing the MTU on the RADIUS server, or see if the PA has some option to help with MTU adjustment. Remember - RADIUS is UDP based.

Re: Radius Timeout Issues - remote site

pjc — Thu, 12 Oct 2023 12:32:29 GMT

I have the same issue at a few of our SD-WAN sites with Radius and EAP-TLS certs. My solution was to use the Meraki Cloud Radius Proxy for these sites - the request goes out directly across the internet (Not over SDWan where there is added VPN packet overhead) to the radius proxy and then onward into datacentre where the request is accepted and returned back to the cloud radius and onto the WAN site.

Note: The meraki radius test feature (where there is no added user certs packet overhead) worked fine at these sites where it was only using username/pw authentication

I found changing MTU size on NPS radius made no difference - you have little or no control on the MTU size across your ISP links etc

Some pings showing packet fragmentation and comparing against working sites may help you check if MTU is your issue

Re: Radius Timeout Issues - remote site

Shewie — Thu, 12 Oct 2023 12:38:42 GMT

Thanks everyone for the replies, we're just working through some of the suggestions and will report back if we make any progress

Re: Radius Timeout Issues - remote site

Paccers — Fri, 13 Oct 2023 07:02:15 GMT

+1 for MTU, we had issues with this exact problem and Access-Rejects due to timeouts. Setting the relevant NPS policy (Windows server) with a Framed-MTU of 1344 fixed it for us