如何对 Radius 身份验证失败进行故障排除

配置 Radius 服务器时对身份验证失败消息进行故障排除。

• 帕洛阿尔托Firewall或者 Panorama
• 支持的 PAN-OS
• 半径认证

1. 验证系统日志消息以确认身份验证失败 (CLI “显示日志系统“或者GUI:监控 > 日志 > 系统)
2. 通常消息表示“身份验证失败”

User 'TESTCORP\xxxxxx' failed authentication. Reason: Invalid username/password From:x.y.m.n.

3. 打开 authd.log (少 mp-log authd.log ) 并同时验证日志。

debug: pan_authd_radius_create_req_payload(pan_authd_radius.c:230): username: xxxxxx
debug: pan_make_radius_request_buf(pan_authd_radius_prot.c:390): RADIUS request type: PAP
debug: pan_authd_radius_parse_resp_payload(pan_authd_radius.c:285): resp_code = RAD_ACCESS_REJECT
debug: pan_auth_service_recv_response(pan_auth_service_handle.c:1612): Got response for user: "t118009"
Error: pan_rad_process_response(pan_authd_radius_prot.c:255): Invalid RADIUS response received - Bad MD5, it might be caused by mismatched shared secret between server profile and remote RADIUS server

4. 如果消息指示“RAD_ACCESS_REJECT”后跟“错误的 MD5 "，通常是错误的共享秘密。 更正共享密钥以解决问题。
5. 如果消息指示“RAD_ACCESS_REJECT”后跟“用户的 PAN_AUTH_FAILURE 身份验证响应"，通常不授予密码或远程拨入访问权限

debug: _authenticate_by_localdb_or_remote_server(pan_auth_state_engine.c:1829): Authenticating user "xxxxx" with <profile: "XYX_Radius", vsys: "vsys1">
debug: _retrieve_svr_ids(pan_auth_service.c:648): find auth server id vector for XYX_Radius-vsys1
debug: pan_authd_radius_create_req_payload(pan_authd_radius.c:230): username: xxxxx
debug: pan_make_radius_request_buf(pan_authd_radius_prot.c:390): RADIUS request type: PAP
debug: pan_authd_radius_parse_resp_payload(pan_authd_radius.c:285): resp_code = RAD_ACCESS_REJECT
debug: pan_auth_service_recv_response(pan_auth_service_handle.c:1583): Got response for user: "xxxxx"
debug: pan_auth_response_process(pan_auth_state_engine.c:4298): auth status: auth failed
debug: pan_auth_incr_failed_attempt(pan_authd_db.c:171): increase failed attempt for user: admin
debug: pan_auth_response_process(pan_auth_state_engine.c:4477): Authentication failed: <profile: "XYX_Radius", vsys: "vsys1", username "xxxxx">
failed authentication for user 'admin'. Reason: Invalid username/password. auth profile 'XYX_Radius', vsys 'vsys1', server profile 'XYX_RAD_Servers', server address '10.90.X.T', auth protocol 'PAP', From: 10.92.M.N.
debug: _log_auth_respone(pan_auth_server.c:268): Sent PAN_AUTH_FAILURE auth response for user 'xxxxx' (exp_in_days=-1 (-1 never; 0 within a day))(authd_id: 6795007509200667545) (return domain 'corp')

6. 如果密码正确，检查AD服务器权限：下Active Directory 用户和计算机，在用户的属性中，在拨号选项卡>允许访问：