topic Re: RADIUS Disconnect-Request Issue in Network Platform API

RADIUS Disconnect-Request Issue

nkarstedt — Tue, 17 Jul 2018 21:54:44 GMT

I'm having a real issue getting RADIUS Disconnect-Messages working with our solution. I've tested and compared them to a quick test I made in FreeRADIUS, which works fine, but my implementation appears the same, yet does not work. I've attached a PCAP that includes the Access, Accounting, and Disconnect Request messages. I'm not currently getting back the response. I have confirmed that the Disconnect-Request can reach Internet destinations by sending disconnect messages to a computer running wireshark off-network.

My RADIUS Server is behind an F5, so it doesn't hold the actual public IP, thus the 10. address.

Accounting StartDisconnect Request

Please advise!

Download the PCAP off Google Drive

Re: RADIUS Disconnect-Request Issue

Philip D'Ath — Wed, 18 Jul 2018 00:16:33 GMT

What kind of device is this against? A switch? An MX? MR?

Re: RADIUS Disconnect-Request Issue

nkarstedt — Wed, 18 Jul 2018 14:46:03 GMT

This is being tested agains MR18s and MR33s

Re: RADIUS Disconnect-Request Issue

justinmark — Sun, 07 Jul 2019 15:38:00 GMT

I'm having same issue with MR18. Do you have any resolution to this issue?

Re: RADIUS Disconnect-Request Issue

nkarstedt — Mon, 08 Jul 2019 15:00:23 GMT

I did. Adding the outbound IP address as a RADIUS authentication server solves the problem.

Re: RADIUS Disconnect-Request Issue

justinmark — Tue, 09 Jul 2019 02:41:06 GMT

Hi nkarstedt,

I'm little confuse. Where did you add the IP Address of Radius authentication server? From your firewall? Thanks!

Re: RADIUS Disconnect-Request Issue

nkarstedt — Tue, 09 Jul 2019 02:46:09 GMT

Correct. When behind an LB, outbound traffic will come from its IP. If you're behind an application configured on the FW/LB, you'll get the same IP from any internet application that will expose your IP (Different from those than can reach your IP FROM the internet). That's the IP that the Meraki cloud will see and must verify as a valid authentication server.

Re: RADIUS Disconnect-Request Issue

justinmark — Wed, 10 Jul 2019 11:46:12 GMT

Hi nkarstedt,

Thanks! I'll apply your solution to my setup