As long as these wizards have not ran, nothing is going to work - at least when you're using Verify Access for the integration. So I wonder what/how you managed to make that radclient call work through the Gateway. Or were you using Verify SaaS there?
What does the trace file of the Gateway say? Do you see the Radius calls coming in when connecting via the RADIUS client? And when you do the radclient call from the Gateway server, do you see an "authentication successful" message?
Further isolate the problem by running the radclient (or another Radius test client app) from the Radius client's server (2.2.2.2 as you call it).
Just to make sure: did you restart the Gateway after changing the configuration (of the client IP)?
Original Message:
Sent: Mon January 20, 2025 08:36 AM
From: Eric Hoffmann
Subject: Ibm radius server
Hi Peter,
Thank you for your answer and help. Here is my configuration file:
{
"address": "::",
"port": 1812,
"trace-file": "/tmp/ibm-auth-api.log",
"trace-rollover": 12697600,
"ibm-auth-api": {
"client-id": "********",
"obf-client-secret": "**********", /* See IbmRadius -obf "the-secret" */
"protocol": "https",
"host": "*****.verify.ibm.com",
"port": 443,
"max-handles": 16
},
"clients": [
{
"name": "Forcepoint-SMC",
"address": "2.2.2.2",
"secret": "Passw0rd",
"auth-method": "password",
"use-external-ldap": false,
"reject-on-missing-auth-method": true,
"device-prompt": "A push notification has been sent to your device: [%D].",
"poll-device": true,
"poll-timeout": 60
}
]
}
I still have the same error with only password set.
I am trying to set it up with Verify SaaS as you did in your guide. First, thank you for the amazing tutorial and video recording on YouTube-it really helped.
I installed the Gateway on Linux using the Docker containers.
However, I didn't complete the last step you mentioned, and I don't really understand it exactly. Can you please tell me where the Wizards are located?
On the Gateway server, I am running the following command:
echo "User-Name = test, User-Password = example-password" | radclient -x -s 1.1.1.1:1812 auth Passw0rd
(Here, 1.1.1.1 is the example IP for the Gateway server.) When I run this with the configuration and switch to 2.2.2.2 for 1.1.1.1, it works. However, if I set it up with 2.2.2.2 (example for the Client server IP), it does not work anymore.
I configured PHP as the protocol for communication, as it seems to be the only supported one, as far as I know.
Thanks for your help.
------------------------------
Eric Hoffmann
------------------------------
Original Message:
Sent: Mon January 20, 2025 03:14 AM
From: Peter Volckaert
Subject: Ibm radius server
Hi Eric,
I'm assuming you're setup is using the IBM Security Gateway for RADIUS and integrates with Verify Access, right?
Please share details on your configuration, specifically on how authentication is configured for that RADIUS client. See this link: https://www.ibm.com/docs/en/security-verify?topic=radius-configuring-security-verify-gateway-server
Please isolate the problem e.g. with a setting of auth_method to "password" (i.e. password only).
Also mind the configuration of use-local-pwd-check if you're running the Gateway on Windows.
The Gateway for RADIUS was originally only supported for Verify SaaS, the support for Verify Access that came later on. But the documentation on www.ibm.com/docs on the Gateway's config is not up to date with that ISVA integration.
Just to make sure: did you carefully follow the steps as described over here: https://www.ibm.com/docs/en/sva/11.0.0?topic=configuring-verify-identity-gateway. This is needed to make ISVA understand what the Gateway is sending. What do you see at ISVA's end looking at the runtime trace file?
Hope this helps,
Peter.
------------------------------
Peter Volckaert
Technical Subject Matter Expert
Authentication and Access
IBM Security