Forum Discussion

jmanya_44531's avatar
jmanya_44531
Icon for Nimbostratus rankNimbostratus
Oct 10, 2013

F5 APM Radius+Token Authentication

Hello all,

 

Many days ago I wrote here in order to ask you for support.

 

I need to deploy an APM solution in order to replace Citrix Access Gateway Enterprise Edition (AGEE). I have configured the AAA servers and the network/webtops resources, but the users cannot be even authenticated. I have re-write the radius shared key many times, but the error persists. I have also reviewed that the F5 is the client of the radius. I have the following mechanism for AAA:

 

Currently, users need to put username, password and RSA SecurID token. The Radius server (for authentication) gets a pair composed of user+token. The LDAP server (for authorization) gets a pair composed of user+password. There is Radius authentication over RSA; even, the RSA (RSA Authentication Manager 6.1 on Windows Server 2003) contains the radius server on it. I have been thinking of setting a RSA Server in the APM, but currently in the AGEE there is a Radius (port 1812) declared.

 

Please, could you tell me if there is any bug or something like that in order to deploy this? What could I do, besides everything I have done?

 

Thanks in advance.

 

Regards

 

Jorge

 

APM
deployment
design
security

2 Replies

Sort By
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Oct 11, 2013

    Mmm... What variable names in the login page are you using for the pin+tokencode and the radius password.

     

    IIRC, The auth mechanisms both assume that the variable is password (The securid does, which conflicts with auto login for citrix desktops when using AD auth, I think the Radius will be the same).

     

    So you need to do some copying around of variable names between the securid auth and the radius auth. The good news is that this is quite easy. I do something like

     

    1. Alter the login page to save the pin+token in a variable called pintokencode 2, alter the login page to save the radius pass in a var called radiuspass
    2. just before the securid auth use a variable assignment to copy the pintokencode value to password
    3. just before the radius auth use a variable assignment to copy the radiuspass value to password

    [Some assumptions made in here. YMMV]

     

    H

     

  • jmanya_44531's avatar
    jmanya_44531
    Icon for Nimbostratus rankNimbostratus
    Oct 13, 2013

    Hello Hamish,

     

    Thanks for your answer. I think that my explanation was no clear enough.

     

    I meant that users need to fill out the following fields in order to get access:

     

     

    So, the current VPN Solution has been configured to request authentication and authorization towards to a RSA+Radius Server and LDAP server respectively. So, in the following image you can see how the AVPs are sent in the current environment:

     

     

    Do I need to change the variable names on APM in order to allow a "conversation" between it and the AAA servers?

     

    THanks in advance for your help

     

    Regards

     

    JM