Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a couple of small-business routers (Cisco RV120W) that I use at some of our smaller offices configured with a site-to-site VPN to allow connectivity for devices & such between my main office and the remote endpoints. The RV120W does a fine job of this... and I really can't complain too much. Users have now been asking about setting up WIFI... and having played with the RV120W quite a bit... I know it supports "enterprise authentication" with wpa2. After setting it up and trying to make it work... I quickly discovered that the router isn't sending the RADIUS packets through the VPN tunnel... (packets go out the WAN interface for some dumb reason.)

My last 3 major issues I brought up with Cisco... ended up with a "Won't Fix" ... (even though they admitted it was a bug)... so I don't really feel like battling this problem with them. So, now I'm reconsidering how to approach this problem to make it work despite limitations of the device. As a last ditch effort... I may end up putting a dedicated AP on site behind the router... but I would rather not have yet-another device to maintain at each site.

TL;DR:

How safe is it to throw RADIUS packets over the public internet? Potentially, could the data be intercepted and decrypted? Is there a potential for a replay attack of sorts? Are there other concerns I should be aware of?

share|improve this question

2 Answers 2

Here is the way I see it then. You've called their support and they state there's nothing they can do. IMO this is a routing issue of some sort. I don't know how much you can configure on your device (I presume it doesn't have the cisco IOS running on it). Anyway, let's leave that aside and assume you can't. The option I see are as follows.

  1. Upgrade your routers to a Cisco 881w. This supports RADIUS over a VPN for sure (that's what we do).
  2. Live with the extra AP's. Not actually a bad plan, now your wireless isn't tied into your router. Meaning if a new wifi standard comes out, you can upgrade independently of the router.
  3. You can do RAIDUS over the internet, but since its PAP, I would strongly reccomend you NOT do that.
share|improve this answer
    
Quite sure. Any & all traffic from the clients attached to the router on the LAN side go through the VPN tunnel. But the RADIUS traffic the router generates goes out the WAN interface. If I had a RADIUS server @ that location... I suspect it would go out the LAN interface... but I need it to go through the VPN interface. –  TheCompWiz Jan 12 '12 at 14:13

Are you using PAP? using CHAP would lower some risk. Also what type of WAN are we talking?

If the WAN is to your ISP or a shared network? On a closed network meaning a transport that segregates traffic via VLAN or subnet, or directly to public internet with VLAN or subneting, its not as risky. Going across a more open network using PAP is more risky. Also using PPTP vs XAUTH would be an added level of risky.

Radius servers, should be able, manage spoofed Radius Authe/Autho packets over any network from a malicious nas.

Configuring something like nas shared key, duplicate login, client(nas) id, nas type, packet formating. These combined with the encryption will make it very difficult, but not impossible, to used maliciously.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.