RADIUS servers used do not match across cluster members-paloaltonetworks-panos

Knowledge
, , ,
RADIUS servers used do not match across cluster members-paloaltonetworks-panos
none 4.0 2
#1

RADIUS servers used do not match across cluster members-paloaltonetworks-panos

Vendor: paloaltonetworks

OS: panos

Description:
indeni will identify when two devices are part of a cluster and alert if the RADIUS servers they are using are different.

Remediation Steps:
Review the RADIUS configuration on each device to ensure they match.

How does this work?
This script pulls the Palo Alto Networks firewall’s active configuration and extracts the configured RADIUS servers from there.

Why is this important?
Tracking the currently configured RADIUS servers on all devices is important to ensure consistent authentication and access.

Without Indeni how would you find this?
An administrator may write a script to pull this data from devices and compare against a gold configuration.

panos-show-config-merged-monitoring-xml

Failed to fetch the data: https://bitbucket.org/indeni/indeni-knowledge/src/master/parsers/src/panw/panos/show-config-merged-m/show-config-merged-m.ind.yaml

cross_vendor_radius_servers_comparison

Failed to fetch the data: https://bitbucket.org/indeni/indeni-knowledge/src/master/rules/templatebased/crossvendor/cross_vendor_radius_servers_comparison.scala
#2

It is important to note when RADIUS servers may accidentally be misconfigured or even missing between HA peers. However, in some architecturally specific use cases such as business continuity or disaster recovery, unique RADIUS servers may be required. The primary site RADIUS servers may not become available in the new site/environment if they are not load balanced/mirrored.

This is going to be a unique alert to the Indeni platform. If anyone knows of other systems that monitor this situation please comment. Also, if you have a DR/BC scenario where you wish not to receive this alert you can simply set the alert to be ignored for those devices only.

#3

Interesting, I would think the possibility of someone updating on one device and forgetting to do it on the other. In general it appears to be pretty important for engineers to know what is synced and what is not, across the cluster.