Manual Chapter : RADIUS Authentication

Applies To:

Show Versions Show Versions

BIG-IP APM

  • 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0
Manual Chapter

RADIUS Authentication

About RADIUS authentication

Access Policy Manager supports authenticating and authorizing the client against external RADIUS servers. When a client connects with the user name and password, Access Policy Manager authenticates against the external server on behalf of the client, and authorizes the client to access resources if the credentials are valid.
How RADIUS works
How RADIUS works
  • The client requests access to network resources through Access Policy Manager.
  • Access Policy Manager then issues a
    RADIUS Access Request
    message to the RADIUS server, requesting authorization to grant access.
  • The RADIUS server then processes the request, and issues one of three responses to Access Policy Manager:
    Access Accept
    ,
    Access Challenge
    , or
    Access Reject
    .
If using LDAP or RADIUS authentication in such a way that requires multiple authentication requests, then One Time Password will not work (because password usage is reached on the second request).

About AAA high availability

Using AAA high availability with Access Policy Manager (APM), you can configure multiple authentication servers to process requests, so that if one authentication server goes down or loses connectivity, the others can resume authentication requests, and new sessions can be established, as usual.
Although new authentications fail if the BIG-IP system loses connectivity to the server, existing sessions are unaffected provided that they do not attempt to re-authenticate.
APM supports the following AAA servers for high availability: RADIUS, Active Directory, LDAP, CRLDP, and TACACS+. APM supports high availability by providing the option to create a pool of server connections when you configure the supported type of AAA server.
If you use AAA with pools, such as RADIUS pools or Active Directory pools, APM assigns each pool member with a different number for the pool member's priority group value. APM must define each pool member with a different priority group because AAA load balancing is not used. The priority group number increases automatically with each created pool member. Alternative AAA pool configurations can be defined manually using the full flexibility of Local Traffic Manager (LTM) if high availability is desired.

Guidelines for setting up RADIUS authentication for AAA high availability

When you use RADIUS as the authentication method for AAA high availability, there are general guidelines that you must follow when you set up your server connections.
  • In a non-high availability environment, both the
    Direct
    and
    Use Pool
    options use the self IP address as a source IP address of the packet reaching the RADIUS server. For this scenario, you just need to add one IP address to the RADIUS allowed IP list to achieve this.
  • In a high availability environment where the
    Use Pool
    option is used, the floating self IP address is used as a source IP of the RADIUS packet reaching the back-end. For this scenario, you need to add one self IP address (which is floating self IP address) to the RADIUS allowed IP list because the IP address is used even after a failover occurs.
  • In a high availability environment where the
    Direct
    option is used, the static self IP address is used as a source IP address of the RADIUS packet reaching the back-end. In this scenario, you need to add the self IP address from both active and standby devices to the RADIUS allowed IP list so that when failover occurs, the self IP address from the second device is accepted by the RADIUS server.

About how APM handles binary values in RADIUS attributes

For RADIUS authentication, Access Policy Manager (APM) converts an attribute value to hex if it contains unprintable characters, or if it is the
class
attribute. APM converts the class attribute to hex even if it contains only printable values (by attribute type). No other attributes are encoded to hex if they do not contain unprintable characters.
An attribute with a single unprintable value
1bf80e04.session.radius.last.attr.class 62 / 0x54230616000001370001ac1d423301caa87483dadf740000000000000007
Attribute with multiple values, both printable and unprintable (binary)
243be90d.session.radius.last.attr.class 119 0x6162636465666768696 / a6b6c6d6e6f707172737475767778797a | 0x54220615000001370001ac1d423301caa87483 / dadf740000000000000006
An attribute type that does not require hex encoding with both printable and unprintable values
3888eb70.session.radius.last.attr.login-lat-group 37 / 0x6d7920bda12067726f757032 | mygroup1
In this case, only values that are unprintable are encoded to hex.

Configuring RADIUS authentication

If you add RADIUS authentication to an existing access policy, you already have an access profile configured and the access policy might already include a logon access policy item.

Configuring a RADIUS AAA server in APM

The Access Policy Manager (APM) is a network access server (NAS) that operates as a client of the server configured here.
  1. On the Main tab, click
    Access
    Authentication
    RADIUS
    .
    The RADIUS servers screen opens.
  2. Click
    Create
    .
    The New Server properties screen opens.
  3. In the
    Name
    field, type a unique name for the authentication server.
  4. For the
    Mode
    setting, select
    Authentication
    .
  5. For the
    Server Connection
    setting, select one of these options:
    When configuring a RADIUS AAA server that is located in a nondefault route domain, you must select
    Use Pool
    and specify the pool containing the RADIUS server.
    • Select
      Use Pool
      to set up high availability for the AAA server.
      If you select
      Use Pool
      , the
      Timeout
      value does not apply.
    • Select
      Direct
      to set up the AAA server for standalone functionality.
  6. If you selected
    Use Pool
    , type a name in the
    Server Pool Name
    field.
    You create a pool of servers on this screen.
  7. Provide the addresses required for your server connection:
    • If you selected
      Direct
      , type an IP address in the
      Server Address
      field.
    • If you selected
      Use Pool
      , for each pool member you want to add, type an IP address in the
      Server Addresses
      field and click
      Add
      .
      When you configure a pool, you have the option to type the server address in route domain format:
      IPAddress
      %
      RouteDomain
      .
  8. In the
    Authentication Service Port
    field, type the authentication port number of your server. The default is
    1812
    .
  9. In the
    Secret
    field, type the shared secret password of the server.
  10. In the
    Confirm Secret
    field, re-type the shared secret password of the server.
  11. Click
    Finished
    .
    The new server displays on the list.
The new AAA server displays on the RADIUS Servers list.

Create an access profile

You create an access profile to provide the access policy configuration for a virtual server that establishes a secured session.
  1. On the Main tab, click
    Access
    Profiles / Policies
    .
    The Access Profiles (Per-Session Policies) screen opens.
  2. Click
    Create
    .
    The New Profile screen opens.
  3. In the
    Name
    field, type a unique name for the access profile.
  4. From the
    Profile Type
    list, select one these options:
    • ALL
      : Select to support LTM-APM and SSL-VPN access types.
    • LTM-APM
      : Select for a web access management configuration.
    • OAuth-Resource Server
      : For configuring APM to act as an OAuth resource server that provides an OAuth authorization layer into an API gateway.
    • RDG-RAP
      : Select to validate connections to hosts behind APM when APM acts as a gateway for RDP clients.
    • SSL-VPN
      : Select to configure network access, portal access, or application access. (Most access policy items are available for this type.)
    • SSO
      : Select to configure matching virtual servers for Single Sign-On (SSO).
      No access policy is associated with this type of access profile
    • SWG - Transparent
      : Select to configure access using Secure Web Gateway transparent forward proxy.
    • SWG - Explicit
      : Select to configure access using Secure Web Gateway explicit forward proxy.
    • System Authentication
      : Select to configure administrator access to the BIG-IP system (when using APM as a pluggable authentication module).
    • Identity Service
      : Used internally to provide identity service for a supported integration. Only APM creates this type of profile.
      You can edit Identity Service profile properties.
    Depending on licensing, you might not see all of these profile types.
    Additional settings display.
  5. From the
    Profile Scope
    list, select one these options to define user scope:
    • Profile
      : Access to resources behind the profile.
    • Virtual Server
      : Access to resources behind the virtual server.
    • Global
      : Access to resources behind any access profile with global scope.
    • Named
      : Access for SSL Orchestrator users to resources behind any access profile with global scope.
    • Public
      : Access to resources that are behind the same access profile when the Named scope has configured the session and is checked based on the value and string configured in the Named scope field.
  6. For the
    Customization Type
    , use the default value
    Modern
    .
  7. In the Language Settings area, add and remove accepted languages, and set the default language.
    If no browser language matches one in the accepted languages list, the browser uses the default language.
  8. Click
    Finished
    .
The access profile displays in the Access Profiles List. Default-log-setting is assigned to the access profile.

Verify log settings for the access profile

Confirm that the correct log settings are selected for the access profile to ensure that events are logged as you intend.
Log settings are configured in the
Access
Overview
Event Log
Settings
area of the product. They enable and disable logging for access system and URL request filtering events. Log settings also specify log publishers that send log messages to specified destinations.
  1. On the Main tab, click
    Access
    Profiles / Policies
    .
    The Access Profiles (Per-Session Policies) screen opens.
  2. Click the name of the access profile that you want to edit.
    The properties screen opens.
  3. On the menu bar, click
    Logs
    .
    The access profile log settings display.
  4. Move log settings between the
    Available
    and
    Selected
    lists.
    You can assign up to three log settings that enable access system logging to an access profile. You can assign additional log settings to an access profile provided that they enable logging for URl request logging only.
    Logging is disabled when the
    Selected
    list is empty.
  5. Click
    Update
    .
An access profile is in effect when it is assigned to a virtual server.

Using RADIUS authentication in an access policy

You configure an access policy with a RADIUS Auth action to provide RADIUS authentication as one of authentication options for users trying to gain accesss.
You can use RADIUS authentication in addition to other authentication types. You can require that users pass at least one type of authentication or that they pass multiple types of authentication.
  1. On the Main tab, click
    Access
    Profiles / Policies
    .
    The Access Profiles (Per-Session Policies) screen opens.
  2. In the Per-Session Policy column, click the
    Edit
    link for the access profile you want to configure.
    The visual policy editor opens the access policy in a separate screen.
  3. Click the
    (+)
    icon anywhere in the access policy to add a new item.
    Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
    A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
  4. On the Logon tab, select
    Logon Page
    and click the
    Add Item
    button.
    The Logon Page Agent properties screen opens.
  5. Make any changes that you require to the logon page properties and click
    Save
    .
    The properties screen closes and the policy displays.
  6. Click the
    (+)
    icon anywhere in the access policy to add a new item.
    Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
    A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
  7. From the Authentication tab, select
    RADIUS Auth
    and click
    Add Item
    .
    The popup screen closes. A Properties popup screen opens.
  8. On the Properties popup screen from the
    AAA Server
    list, select the AAA RADIUS server you configured previously and click
    Save
    .
    The popup screen closes and the visual policy editor displays.
  9. Complete the policy:
    1. Add any additional policy items you require.
    2. Change the ending from
      Deny
      to
      Allow
      on any access policy branch on which you want to grant access.
  10. Click
    Apply Access Policy
    to save your configuration.
This creates an access policy that collects user credentials and uses them to authenticate with a RADIUS server.
To apply this access policy to network traffic, add the access profile to a virtual server.
To ensure that logging is configured to meet your requirements, verify the log settings for the access profile.

Creating a virtual server for an access policy

When creating a virtual server for an access policy, specify an IP address for a single host as the destination address.
  1. On the Main tab, click
    Local Traffic
    Virtual Servers
    .
    The Virtual Server List screen opens.
  2. Click
    Create
    .
    The New Virtual Server screen opens.
  3. In the
    Name
    field, type a unique name for the virtual server.
  4. For the
    Destination Address/Mask
    setting, confirm that the
    Host
    button is selected, and type the IP address in CIDR format.
    The supported format is address/prefix, where the prefix length is in bits. For example, an IPv4 address/prefix is
    10.0.0.1
    or
    10.0.0.0/24
    , and an IPv6 address/prefix is
    ffe1::0020/64
    or
    2001:ed8:77b5:2:10:10:100:42/64
    . When you use an IPv4 address without specifying a prefix, the BIG-IP system automatically uses a
    /32
    prefix.
    The IP address you type must be available and not in the loopback network.
  5. In the
    Service Port
    field:
    • If you want to specify a single service port or all ports, confirm that the
      Port
      button is selected, and type or select a service port.
    • If you want to specify multiple ports other than all ports, select the
      Port List
      button, and confirm that the port list that you previously created appears in the box.
  6. From the
    HTTP Profile (Client)
    list, select a previously-created HTTP/2 profile for client-side traffic.
  7. If you use server SSL for this connection, from the
    SSL Profile (Server)
    list, select a server SSL profile.
  8. If you use client SSL for this profile, from the
    SSL Profile (Client)
    list, select a client SSL profile.
  9. In the Access Policy area, from the
    Access Profile
    list, select the access profile that you configured earlier.
  10. From the
    Connectivity Profile
    list, select a connectivity profile.
    You can select the default connectivity profile,
    connectivity
    if you have not defined a specific profile for the traffic that is directed to this virtual server.
  11. Click
    Finished
    .

Test AAA high availability for supported authentication servers

To effectively test that high availability works for your authentication servers, you should have two servers that are accessible, where you can remove one of them from the network.
High availability is supported for these authentication server types only: RADIUS, Active Directory, LDAP, CRLDP, and TACACS+.
If you configured a supported authentication server type to use a pool of connection servers, you can test the configuration using these steps.
  1. Begin a
    tcpdump
    on the Access Policy Manager, using a protocol analyzer, and scanning for packets destined for the specific port for your authentication server.
  2. Log in to the virtual server with both servers active.
  3. Using the
    tcpdump
    records, verify that the requests are being sent to the higher priority server.
  4. Log out of the virtual server.
  5. Disable the higher-priority server.
  6. Log in to the virtual server again.
  7. Verify that the request is being sent to the other server.
  8. Log out again, re-enabling the server, and try one more time to verify that the new requests are being sent to the high priority server.

RADIUS attributes

The following table lists the specific RADIUS attributes that Access Policy Manager sends with RADIUS requests.
Attribute
Purpose
User-Name
Indicates the name of the authenticated user.
User-Password
Indicates the password of the authenticated user.
NAS-IP-Address
Indicates the identifying IP Address of the NAS.
NAS-IPv6-Address
Indicates the identifying IPv6 Address of the NAS.
NAS-Identifier
Indicates the identifying name of the NAS .
Service-Type
Indicates the type of service the user has requested.
NAS-Port
Indicates the physical port number of the NAS that is authenticating the user.

RADIUS session variables for access policy rules

When the RADIUS Auth access policy item runs, it populates session variables which are then available for use in access policy rules. The tables list the session variables for the RADIUS authentication access policy item and for a logon access policy item.

Session variables for RADIUS

Session Variable
Description
session.RADIUS.last.result
Provides the result of the RADIUS authentication. The available values are:
  • 0: Failed
  • 1: Passed
session.RADIUS.last.attr.$attr_name
$attr_name
is a value that represents the user’s attributes received during RADIUS authentication. Each attribute is converted to separate session variables.
session.RADIUS.last.errmsg
Displays the error message for the last login. If
session.RADIUS.last.result
is set to 0, then
session.RADIUS.last.errmsg
might be useful for troubleshooting purposes. Example:
c76a50c0.session.RADIUS.last.errmsg 13 Access-Reject

Common session variables

Session Variable
Description
session.logon.last.username
Provides user credentials. The
username
string is stored after encrypting, using the system's client key.
session.logon.last.password
Provides user credentials. The
password
string is stored after encrypting, using the system's client key.

RADIUS authentication and accounting troubleshooting tips

You might run into problems with RADIUS authentication and accounting in some instances. Follow these tips to try to resolve any issues you might encounter.

RADIUS authentication and accounting access policy action troubleshooting

Possible error messages
Possible explanations and actions
Authentication failed due to timeout
  • Verify that Access Policy Manager is configured as a client on the RADIUS server.
  • You might have encountered a general network connection problem.
Authentication failed due to RADIUS access reject
  • Verify that the shared secret on the RADIUS server is valid.
  • Verify that user credentials are entered correctly.

Additional troubleshooting tips for RADIUS authentication and accounting

Action
Steps
Check to see if your access policy is attempting to perform authentication
  • Add message boxes to your access policy to display information about what the access policy is attempting to do.
  • Refer to
    /var/log/apm
    to view authentication and accounting attempts by the access policy.
Make sure that your log level is set to the appropriate level. The default log level is
notice
.
Check the RADIUS Server configuration
  • Confirm that the Access Policy Manager is registered as a RADIUS client. Since the Access Policy Manager makes requests from the self IP address to the RADIUS server for authentication requests, the address of the self-IP address should be registered as a RADIUS client.
  • Check the RADIUS logs and check for any errors.
Confirm network connectivity
  • Access the BIG-IP system through the command line interface and check your connectivity by pinging the RADIUS server using the host entry in the AAA Server box.
  • Confirm that the RADIUS port 1812 is not blocked between the Access Policy Manager and the RADIUS server.
Capture a TCP dump
  • Take a TCP dump from the Access Policy Manager when authentication attempts are made. For example, %TCP dump-i 1.1 -s /tmp/dump. You must first determine what interface the self IP address is on. These TCP dumps indicate activities between the Access Policy Manager and the authentication server.
  • Run the authentication test. After authentication fails, stop the TCP dump, download the TCP dump records to a client system, and use an analyzer to troubleshoot.
If you decide to escalate the issue to customer support, you must provide a capture of the TCP dump when you encounter authentication issues that you cannot otherwise resolve on your own.