Issues with radius request over L2L tunnel

[Chess Norris]

Hello,

I have a FTD (managed by FMC) with a RA VPN profil where I have configured ISE as AAA server. The ISE server is located in a remote site behind another FTD, so I have creted a L2L between both FTD's. The tunnel works and I have no issue accessing either the ISE server or other resources over the tunnel. The problem is that the radius request from my local FTD newer seems to make it over the tunnel. I can see the radius request in the local logs but they newer shows up in the remote logs. However, if I do a packet-tracer from my local FTD, using the inside interface as a source and ISE as destination, then I will see the traffic in the remote logs.

Here is how I have configured the AAA server that my VPN profile is using

Anyone else using a similiar setup with radius authentication over L2L tunnel and know what the issue might be?

Thanks

/Chess

[balaji.bandi]

as long as you have routing in place for the destination use Tunnel interace to reach other side, and same other side back using tunnel that should work as expected.

also check both the side packet sent and received no blocks ?

[Chess Norris]

Hello Balaji,

The tunnel is policy based and there is no issues sending traffic over the tunnel. Both packet-tracer and ping tcp from my FTD to the ISE server over the tunnel works. I also checked the firewall rules on either side and there is no blocks. 

Thanks

/Chess

[MHM Cisco World]

You need 

Access - management 

I think you need flexconfig to add this command.

[Chess Norris]

Thanks, but I already have the following configured via flexconfig - management-access inside.

This VPN profile was working before but I haven't used it in a long time, so I'm trying to figure out what happened and why it stopped working. On my local FTD, I am using a dynamic VPN interface, but that shouldnt matter, right? 

Thanks

/Chess

[MHM Cisco World]

dynamic VPN interface 
are peer known new VPN IP ?

[Chess Norris]

Yes, the tunnel is working fine and I have no other problems connecting to other remote resources over the tunnel. It just radius requests from the local FTD that not getting through. If have tried with the "test aaa-server authentication" command from the local FTD, but it just gives me the following error "ERROR: Authentication Server not responding: No active server found"

However, a tcp ping works fine. (I cannot test with the real radius port since it udp, so I use 443 instead for the test)

x.x.x.x=ise server ip

y.y.y.y=FTD inside IP

ftd01# ping tcp inside x.x.x.x 443 source y.y.y.y 1125
Type escape sequence to abort.
Sending 5 TCP SYN requests to x.x.x.x port 443
from y.y.y. starting port 1125, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/3 ms

When looking at the logs on the remote site, I can also verify that my TCP ping is reaching the other side of the tunnel

Thanks

/Chess

[Chess Norris]

I think my issue might be related to this

Update Firepower FDM to 7.2.5 management-access FlexConfig dont work 

I recently upgraded to version 7.2.5, so that might explain why it was working before.

One more thing. I did a test and change AAA in my RA VPN profile from radius (ISE) to my AD server (the AD server is also on the other end of the VPN tunnel on the same network as the ISE server) and that worked. I have no ide why, but it did. 

Does anyone else have problem with the managemnt-access flexconfig command after upgrading to 7.2.5?

I have another firewall with version 7.3.1 and I have the same problem there, so it might affect other versions too.

Thanks

/Chess

[MHM Cisco World]

Hi friend 

I check bug and find show same behavior as you see.

The workaround is using outside as interface to connect to ISE not inside.

[Marvin Rhoads]

I have heard of people having issues with RADIUS packets being fragmented over an IPsec VPN. Here are a couple of clue that may help you with your issue, even though they are with different RADIUS servers and VPNs:

https://community.spiceworks.com/topic/1955385-mtu-question

https://learn.microsoft.com/en-us/answers/questions/329662/problem-with-fragmentation-nps-wont-authenticate-c