Business Community > Routers > Internal routing error Radius Server over IPsec S2S VPN
< Routers

Internal routing error Radius Server over IPsec S2S VPN

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

Internal routing error Radius Server over IPsec S2S VPN

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Internal routing error Radius Server over IPsec S2S VPN
Internal routing error Radius Server over IPsec S2S VPN
2022-04-24 21:51:33
Model: ER605 (TL-R605)  
Hardware Version: V1
Firmware Version: V1_1.2.0 Build 20220114

We have a problem with multiple routes ER605 Firmware ER605(UN)_V1_1.2.0 Build 20220114 We have several ER605 routers in various smaller locations. Which are connected to our head office (OPNsense) via VPN (IPSec S2S). There is a Radius server here that we want to use for wifi authentication. Which unfortunately doesn't work, because the ER605 probably won't reach them. However, a client connected to an ER605 can reach it. It looks to us that the ER605 does not send its own requests to the VPN (a ping to the Radius server from the ER605, for example, does not work either, but on a PC that is connected to the ER605)

  0      
 
  0      
 
#1
Options
6 Reply
Re:Internal routing error Radius Server over IPsec S2S VPN
2022-04-26 09:45:58

  @Stefan_Vogel 

 

Did you use the Diagnostics tool on the ER605 to do the ping test?
Try selecting Interface as WAN.

File:
Just striving to develop myself while helping others.
  0  
  0  
#2
Options
Re:Internal routing error Radius Server over IPsec S2S VPN
2022-04-26 12:03:49

  @Virgo Yes we use the ping function of the ER605 and also on different Lan and Wan interfaces. A ping of the ER605 from the other side (OPNsense) of the VPN works. Web access to the ER605 via the VPN also works. Also a ping from and to OPNsense to a computer connected to the ER605 Only the ping straight from the ER605 to OPNsense does not work. and the ER605 cannot reach our Radius Server via the VPN

  0  
  0  
#3
Options
Re:Internal routing error Radius Server over IPsec S2S VPN
2022-04-27 07:22:50

Dear @Stefan_Vogel ,

 

Stefan_Vogel wrote

  @Virgo Yes we use the ping function of the ER605 and also on different Lan and Wan interfaces. A ping of the ER605 from the other side (OPNsense) of the VPN works. Web access to the ER605 via the VPN also works. Also a ping from and to OPNsense to a computer connected to the ER605 Only the ping straight from the ER605 to OPNsense does not work. and the ER605 cannot reach our Radius Server via the VPN

 

Yes, it's OK that the ping won't work.

 

The mechanism is like this, if you choose LAN for Interface, then the data will go directly to the routing table in LAN, if you choose WAN, the data will go directly out from WAN, neither of them will go through the VPN channel, it is normal that the ping won't work.

 

Please no need to worry that, it will not influence the actual usage.

 

Best Regards!

Best Regards! >> Omada EAP Firmware Trial Available Here << >> Get the Latest Omada SDN Controller Releases Here << *Try filtering posts on each forum by Label of [Early Access]*
  0  
  0  
#4
Options
Re:Internal routing error Radius Server over IPsec S2S VPN
2022-04-27 10:07:40

  @Hank21 for the ping ok. But the problem is that the router does not send the query for the Radius server through the VPN either. This means that authentication via a radius server that can be reached via VPN is not possible. but it is precisely because of such things that one makes the VPN.

  0  
  0  
#5
Options
Re:Internal routing error Radius Server over IPsec S2S VPN
2022-04-29 06:15:36

Dear @Stefan_Vogel ，

 

Stefan_Vogel wrote

  @Hank21 for the ping ok. But the problem is that the router does not send the query for the Radius server through the VPN either. This means that authentication via a radius server that can be reached via VPN is not possible. but it is precisely because of such things that one makes the VPN.

 

Based on your description, the following two scenarios are discussed.
1. If you only find that the PC behind the ER605 can not use that authentication system, then please check whether the PC can ping through to the Radius Server on the other side?


2. If you want the portal set on the controller to be applied to the EAP, then you need to check that the local network at both ends contains all subnets when the VPN is set up. Generally speaking, if the controller can manage the EAP properly, the portal will work.

 

Best Regards!

Best Regards! >> Omada EAP Firmware Trial Available Here << >> Get the Latest Omada SDN Controller Releases Here << *Try filtering posts on each forum by Label of [Early Access]*
  0  
  0  
#6
Options
Re:Internal routing error Radius Server over IPsec S2S VPN
2022-04-29 08:00:22

  @Hank21 Thank you for your support.
To 1. A PC behind the ER605 can reach the radius server via the VPN. (But don't really need it.)
to 2. the Omada Controller can reach and control all EAPs. That works because in the ER605 in the DHCP field 138 the IP of the Omada controller is entered.
but that's really not the point.
(By the way, the ER605 is not adopted by the Omada controller. We use the Omada controller only and exclusively for the W-Lan aces points.)
The guest authentication has nothing to do with the omada controller or the EAPs.
(we also have a wired guest network that uses authentication)

it's all about the Radius Authentication function of the ER605. we use the ER605's internal custom page.
this is also displayed to the client.
the radius server is of course defined by IP (192.168.10.5) and port in the ER605.
but the authentication does not work.
Unfortunately, there is no more precise error information in the ER605 (not even in the log) only "authentication failed".

But we don't see any requests in our radius server either of the ER605, strictly speaking, our Radius server does not receive a single packet from the ER605.

The pure internal authentication in the ER605 works of course.
We therefore assume that the ER605 does not send the requests to the Radius server through the VPN.

I'll take screenshots of the settings later

  0  
  0  
#7
Options

Information

Helpful: 0

Views: 728

Replies: 6

Related Articles
IPsec for DDNS server
790 0
 Internal radius for router
503 5
Omada Radius server get CORS error when use https
704 0
routing
257 0
Unknown routing in routing-table
371 0
 Help with ER605: internal web server
2051 0
About Us
Press
Copyright © TP-Link Systems Inc. All rights reserved.