<table width="100%" cellpadding="0" cellspacing="0" border="0">
<tr>
<td height="20" BGCOLOR="#005FA8" BORDERCOLOR="#003E6A" align="center" style="border:1px solid #003E6A;">
<a href="http://www.zixcorp.com/get-started/" target="_blank" style="text-decoration: none;"><FONT FACE="ARIAL" COLOR="#FFFFFF"><span style="color: #ffffff; font-family:'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 20px; font-size:13px; text-shadow: 0px -1px 1px #003E6A; white-space:nowrap;">This message was sent securely using </span></FONT><FONT FACE="TIMES" COLOR="#FFFFFF"><span style="font-family: Georgia, Times, 'Times New Roman', serif; color:#ffffff; font-size:13px; padding: 0; text-shadow: 0px -1px 1px #003E6A; white-space:nowrap;">Zix</span></FONT><FONT FACE="ARIAL" COLOR="#FFFFFF"><span style="color: #ffffff; font-family:'Helvetica Neue', Helvetica, Arial, sans-serif; font-size:13px; text-shadow: 0px -1px 1px #003E6A; white-space:nowrap;">Corp.</span></FONT></a>
</td>
</tr>
</table>
<BR>
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">First time poster here. I have Suricata in-line running in af-packet mode using the binary packages in the apt repository, IP tables completely empty on Ubuntu 16.04, fully patched. It sits between my router and switch on an 802.1q trunk.
All services work fine for wired clients on all 4 VLANs. Radius logons work to my cisco catalyst switch (UDP 1645 auth/1646 accounting), but my Meraki WAP’s radius fails (UDP 1812-auth). If I disable Suricata and flip my inline pair to a bridge it works
just fine. I considered that maybe it was just 1812 and switched the Meraki’s to use 1645, same behavior. If I capture packets from the IPS, from the perimeter router, from the core firewall, and from the RADIUS server itself it looks the same:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Access-Request WAP->Radius Server<o:p></o:p></p>
<p class="MsoNormal">Access-Challenge Radius Server->WAP<o:p></o:p></p>
<p class="MsoNormal">Access-Request WAP->Radius Server<o:p></o:p></p>
<p class="MsoNormal">Access-Challenge Radius Server->WAP (fragmented and re-assembled)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What’s weird is I see nothing in fast.log or drop.log referencing my AP’s IP, nor my Radius server so one would think that means it’s not acting on it, but the problem goes away when it’s bypassed.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I can included sanitized config snippets if that’s helpful?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On my inline pair I’m disabling the following features on each nic, 0 being the “outside” 1 being the “inside”.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># ETH0<o:p></o:p></p>
<p class="MsoNormal">auto enp0s20f0<o:p></o:p></p>
<p class="MsoNormal"> iface enp0s20f0 inet manual<o:p></o:p></p>
<p class="MsoNormal"> up ifconfig $IFACE 0.0.0.0 up<o:p></o:p></p>
<p class="MsoNormal"> up ip link set $IFACE promisc on<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE tso off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE gro off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE lro off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE gso off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE rx off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE tx off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE sg off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE rxvlan off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE txvlan off<o:p></o:p></p>
<p class="MsoNormal"> down ip link set $IFACE promisc off<o:p></o:p></p>
<p class="MsoNormal"> down ifconfig $IFACE down<o:p></o:p></p>
<p class="MsoNormal"># ETH1<o:p></o:p></p>
<p class="MsoNormal">auto enp0s20f1<o:p></o:p></p>
<p class="MsoNormal"> iface enp0s20f1 inet manual<o:p></o:p></p>
<p class="MsoNormal"> up ifconfig $IFACE 0.0.0.0 up<o:p></o:p></p>
<p class="MsoNormal"> up ip link set $IFACE promisc on<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE tso off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE gro off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE lro off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE gso off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE rx off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE tx off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE sg off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE rxvlan off<o:p></o:p></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE txvlan off<o:p></o:p></p>
<p class="MsoNormal"> down ip link set $IFACE promisc off<o:p></o:p></p>
<p class="MsoNormal"> down ifconfig $IFACE down<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any help or advice would be greatly appreciated,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Dylan <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>
<BR>
<BR>
<BR>
-------------------------------------------------------------------------
<BR>
<font face="arial" color="#000000" size="2">This message was secured by <strong><a
href="http://www.zixcorp.com"><font color="#0038A8">Zix</font><font
color="#6D5E51">Corp</font></a><sup>(R)</sup></strong>.</font>