Radius server not returning Filter-id information to access device

Question

I have set up a Radius server (v. 4.15 16 april 2003) on NW65sp2 server
and I'm trying to use it to authenticate to a Watchguard Firebox II
firewall. The authentication functions but apparently the firewall is
not getting (or not parsing) the Filter-Id information to assign access
rights via groups. When I login to the firewall with "user1", the
response is "Authenticationsucceeded, but no access grantedfor user". If
I define "user1" on the firewall and assign it to an access policy, then
everything works. But if I define an access group "group1" and assign
it to an access policy on the firewall and then assign "group1" to the
eDir Access Profile object that is assigned to "user1", (Filter-Id =
group1) I get the above authentication succesful, but no access granted.
Is there a way to identify exactly what information is being sent from
the Radius server to the access device so I can determine if the problem
is on the Novell Radius server side or the Watchguard Firewall side?
I've activated the Radius Debug Log, but that only tells me that it
finds all the relevant objects in eDirectory and that authentication is
successfull, but there is no indication that any other information is
being sent to the access device.
As I understand it, the filer-id's are supposed to allow a link between
the eDir user objects and what access rights are allowed on the access
device (firewall). Essentially this is how I define group memberships on
the firewall using eDir user. Is this assumption correct?
The goal of course is to allow access over the firewall without having
to type in 500 user names on the firewall.
Any ideas or tips on what I could check or configure differently would
be helpful. thanks
bill reading

Answer 1

thanks for the feedback. I will take a look at the thread you mentioned
and I'll get back to you with the trace as soon as I can arrange it.
Scott Kiester wrote:
> There is a thread titled "RADIUS Group with VASCO Digipass" in this group
> from November where someone else was trying to use the filter-Id attribute
> with their firewall. The customer was able to get this attribute to working
> after tweaking his RADIUS configuration.
>
> Your understanding of the filter-Id attribute is correct. Either the RADIUS
> server is not sending this attribute for some reason, or something on your
> firewall has been misconfigured. A good starting point would be to take a
> sniffer trace to see if the filter-Id attribute is in the access-request
> packet. (You can use Ethereal, which is a free download from
> www.ethereal.com, for the trace.) Post the trace here or send it to me at
> [email protected] and I'll take a look at it.
>
>
>>>>bill reading<[email protected]> 12/07/04 8:36 AM >>>
>
> I have set up a Radius server (v. 4.15 16 april 2003) on NW65sp2 server
> and I'm trying to use it to authenticate to a Watchguard Firebox II
> firewall. The authentication functions but apparently the firewall is
> not getting (or not parsing) the Filter-Id information to assign access
> rights via groups. When I login to the firewall with "user1", the
> response is "Authenticationsucceeded, but no access grantedfor user". If
> I define "user1" on the firewall and assign it to an access policy, then
> everything works. But if I define an access group "group1" and assign
> it to an access policy on the firewall and then assign "group1" to the
> eDir Access Profile object that is assigned to "user1", (Filter-Id =
> group1) I get the above authentication succesful, but no access granted.
> Is there a way to identify exactly what information is being sent from
> the Radius server to the access device so I can determine if the problem
> is on the Novell Radius server side or the Watchguard Firewall side?
> I've activated the Radius Debug Log, but that only tells me that it
> finds all the relevant objects in eDirectory and that authentication is
> successfull, but there is no indication that any other information is
> being sent to the access device.
>
> As I understand it, the filer-id's are supposed to allow a link between
> the eDir user objects and what access rights are allowed on the access
> device (firewall). Essentially this is how I define group memberships on
> the firewall using eDir user. Is this assumption correct?
>
> The goal of course is to allow access over the firewall without having
> to type in 500 user names on the firewall.
>
> Any ideas or tips on what I could check or configure differently would
> be helpful. thanks
>
> bill reading
>
>