Skip to main content
Daryaya
Daryaya
Visitor III
September 1, 2020
Question

Authentication using RADIUS and LDAP

  • September 1, 2020
  • 4 replies
  • 5922 views

Hi,

we use radius server for authenticating our ssl vpn internal users and LDAP for authentication our ssl external users.

on the firewall we only have user groups, and all the individual users then get created on Radius server or AD. 

my question is as a user try to login to vpn, how firewall as the endpoint that passing the authentication request to the external servers, know which group a user belongs to? or from what setting/conditions it knows it is an external user or internal.

 

 

Thanks

    4 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    September 1, 2020

    It wouldn't know unless you separate them by realms. I would just look up (or down) the policies top to the bottom. So try the first first policy first then if not mach, try the second. Obviously takes longer time for the second group. I recommend using realms instead, which would be much cleaner to me.

    Daryaya
    DaryayaAuthor
    Visitor III
    September 2, 2020

    we dont use realm (does it work with tunnel mode?)

    as we don't have realm does it mean, does it mean firewall send the credentials to both Radius and LDAP servers concurrently?

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    September 2, 2020

    It doesn't matter if tunnel mode or not to use realms. It's just a way to jump into a particular group and portal directly.

    Although I haven't tested it, I don't think it would process two separate policies at the same time, but go one by one. You can easily test it by sniffing those auth request/reply packets.

    Terms & ConditionsAccessibility statement