Wireless Access

Hi everyone,

We recently started trying to enable that our RADIUS server would forward accounting packages to the firewall so that there would be some sort of SSO.

We use radius for 802.1x on wired and wireless (WPA2 Enterprise), from wireshark traces it seems that only connections/reauth to wired switches seem to trigger Authentication packages being sent, this makes me suspect that there is something different in the way the Mobility Master/Controller stack is handling radius as opposed to the switches.

I dug around a bit in the WUI of the Mobility Master but did not find any settings related to radius accounting.

Looking for ideas :) Thanks!

Tech specs -
ArubaOS 8.7.1.2
MM - 2x VM
Controllers - 2x 7030

------------------------------
Keeper of the Keys
------------------------------

Do you have a radius accounting server group configured in the AAA profile?

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
------------------------------

Original Message:
Sent: Apr 29, 2021 12:15 PM
From: E.S. Rosenberg
Subject: RADIUS Accounting messages

Hi everyone,

We recently started trying to enable that our RADIUS server would forward accounting packages to the firewall so that there would be some sort of SSO.

We use radius for 802.1x on wired and wireless (WPA2 Enterprise), from wireshark traces it seems that only connections/reauth to wired switches seem to trigger Authentication packages being sent, this makes me suspect that there is something different in the way the Mobility Master/Controller stack is handling radius as opposed to the switches.

I dug around a bit in the WUI of the Mobility Master but did not find any settings related to radius accounting.

Looking for ideas :) Thanks!

Tech specs -
ArubaOS 8.7.1.2
MM - 2x VM
Controllers - 2x 7030

------------------------------
Keeper of the Keys
------------------------------

Nope I missed that :facepalm: (though in my defense it's not in the WUI only in the profile editor)

Thanks now it's sending Accounting messages to the radius servers :) next step - parse them properly in the firewall.

------------------------------
Keeper of the Keys
------------------------------

Original Message:
Sent: Apr 29, 2021 12:26 PM
From: Colin Joseph
Subject: RADIUS Accounting messages

Do you have a radius accounting server group configured in the AAA profile?

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

Original Message:
Sent: Apr 29, 2021 12:15 PM
From: E.S. Rosenberg
Subject: RADIUS Accounting messages

Hi everyone,

We recently started trying to enable that our RADIUS server would forward accounting packages to the firewall so that there would be some sort of SSO.

We use radius for 802.1x on wired and wireless (WPA2 Enterprise), from wireshark traces it seems that only connections/reauth to wired switches seem to trigger Authentication packages being sent, this makes me suspect that there is something different in the way the Mobility Master/Controller stack is handling radius as opposed to the switches.

I dug around a bit in the WUI of the Mobility Master but did not find any settings related to radius accounting.

Looking for ideas :) Thanks!

Tech specs -
ArubaOS 8.7.1.2
MM - 2x VM
Controllers - 2x 7030

------------------------------
Keeper of the Keys
------------------------------