External radius server

[john_kay_k2wnou]

I have a bunch of ZD1200 and ZD3000 units at multiple sites. I am wanting to setup a Windows Server 2016 box to use NPS for radius. I am having a difficult time getting this to work. My best guess is an issue with routing/nat.

In my test lab I have a ZD behind a Cisco ASA. The ZD has a private IP but has internet access. The Radius server is behind another ASA with a private IP and has internet access. I can never get traffic all the way to the radius server from the ZD.

Can someone share some insight?

Thank you

[michael_brado]

Hm, double NAT... what IP do you tell the ZD to use for your RADIUS server, and vice versa?
You probably need routes to those IPs on the inside of both sides, and port-forward of the IP to their NAT-translated inside IPs (on both sides).
Have you sniffed your wire to see if packets go out and/or ever come back (on either side)?

[john_kay_k2wnou]

On the ZD i told it the radius server was the public IP that the radius server was on. then on the windows NPS i gave the public IP that the AP i was connecting to was on.

I did port forwarding on the ASA that the Windows NPS server is on to forward port 1814 to the private IP of the radius server.

I could give the radius server it's own public IP and not have to use NAT on it. On the ZD side how did you configure the nat to work?

Thank you for your response.

[tony_heung]

It is worth running packer-tracer on the ASA inside interface (on the ZD side) to the NPS ip.  You can verify if all the phases are permitted (eg: UN-NAT, ACLs, NAT, IP-OPTIONS, and FLOW-CREATION), and the final message should be "ALLOW".  I had seen issue without inspection map configured so running the packet-tracer can isolate the issue not on the ASA config, then you can focus on the endpoints (ie: ZD and NPS).

--tony

[john_kay_k2wnou]

tony,

According to packet trace I am able to choose the outside interface. The source IP of the public IP of the ZD to the private IP of the NPS server on port 1814 and it seems to work.

So chances are it's an issue with NAT on the ASA in front of the ZD it seems?