FMC 7.6.2 - Issues with GUI access after the upgrade - Radius

[SeaBeeBee]

We can no longer log in to the Administrator-level account after installing software version 7.6.2 (previously 7.4.2). Nothing has changed on the RADIUS server side or in the external RADIUS authentication settings.

User testing confirms that the correct RADIUS attributes are being returned by the server, but users are still receiving Read-Only access.

Is anyone else having similar issues?

 

[Rob Ingram · Accepted solution]

@SeaBeeBee the issue is possibly related to the Message-Authenticator warning you have in your output. From FMC/FTD version 7.6 the message-authenticator attribute can be configured. I would check the setting on the FMC and RADIUS server. 

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/release-notes/threat-defense/760/threat-defense-release-notes-76.html

Require the Message-Authenticator attribute in all RADIUS responses.

Upgrade impact. After upgrade, enable for existing servers.

You can now require the Message-Authenticator attribute in all RADIUS responses, ensuring that the threat defense VPN gateway securely verifies every response from the RADIUS server, whether for RA VPN or access to the device itself.

The Require Message-Authenticator for all RADIUS Responses option is enabled by default for new RADIUS servers. We also recommend you enable it for existing servers. Disabling it may expose firewalls to potential attacks.

New CLI commands: message-authenticator-required

[SeaBeeBee]

Thank you, Rob.
That was it. We are getting admin access now, after removing the check mark next to: Message Authenticator - RADIUS Server-Enabled Message Authenticator.