Issue with multi wan & high availability setup - authenticating with radius

se_marc · Mar 13, 2022, 4:38 AM

When I try to authenticate with external RADIUS in a multi-wan high availability setup, authentication fails.

My main ISP WAN IP info:
WAN gateway 10.99.80.1
WAN CARP 10.99.80.2
Master firewall WAN 10.99.80.3
Backup firewall WAN 10.99.80.4

Secondary ISP WAN info:
WAN gateway 10.20.20.1
WAN CARP 10.20.20.2
Master firewall WAN 10.20.20.3
Backup firewall WAN 10.20.20.4

LAN CARP: 10.10.3.1
Master firewall LAN: 10.10.3.2
Backup firewall LAN: 10.10.3.3

I created a gateway group: "GW_Failover"
10.99.80.1 Tier 1
10.20.20.1 Tier 2

I set firewall rules to use the gateway group.

I set 2 outbound nat rules for my LAN to use each WAN

Some things I've noticed

I have a unifi for controller on my LAN using external
RADIUS authentication for my access points and it works great.
When I do a packet capture on my WAN interface and authenticate from the unifi controller, I see packets going outbound from the WAN CARP 10.99.80.2
When I setup RADIUS on pfsense to use the same external server under System > User Management > Authenticated, authentication fails.
When I do a packet capture, I see packets on the WAN interface going outbound from the WAN interface IP 10.99.80.3 and I never get a response back.

Can anyone please assist?

se_marc · Mar 21, 2022, 7:00 PM

i figured it out.

i needed to add an outbound NAT rule for each WAN.

Interface WAN - Source: "This Firewall" --> NAT to WAN Carp IP
Interface WAN 2 - Source: "This Firewall" --> NAT to WAN 2 Carp IP

se_marc · Mar 22, 2022, 3:05 AM

Although this resolved the issue with radius, now my backup router is unable to ping the internet or wan gateway.

se_marc · Mar 22, 2022, 6:16 PM