Traffic Shaping rules not apply to RADIUS auth traffic?

[KevinH]

Hi guys,

I have an MX with two WANs from different ISPs. WAN1 is primary.

I authenticate my SSID via RADIUS from a RADIUS-as-a-Service on the internet. This is working.

I configured Client VPN with RADIUS authentication and it's working.

My RADIUS-as-a-Service has an option for MFA (TOTP). I want to turn on MFA for Client VPN connections but not wireless connections. I can specify different RADIUS server IPs in the SSID settings and the Client VPN settings. Got that.

My RaaS has multiple public static IPs and recognizes by Source IP. So I would like to RADIUS traffic from SSID auth requests to go out WAN1, and RADIUS traffic for Client VPN auth requests to go out WAN2. That way my RADIUS service knows to only ask for MFA from requests coming from WAN2's IP.

I made the Traffic Shaping rules in Flow Preferences accordingly. But it looks like RADIUS traffic does not obey these rules. Does anyone know if RADIUS traffic are supposed to obey traffic shaping rules?

My Rules are basically:

Protocol:Any  Source:Any  Destination:RaaS-IP-1  DestPort:Any  Preferred uplink:WAN1

Protocol:Any  Source:Any  Destination:RaaS-IP-2  DestPort:Any  Preferred uplink:WAN2

I can tell that all RADIUS traffic looks like it's coming from WAN1. This is because the shared key I use for WAN1 works for both wireless and Client VPN. When I use the shared key meant for WAN2, it doesn't work.

[jdsilva]

I think you mean Internet Flow Preferences, not Traffic Shaping rules?

https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferen...

If you have active flows and then add the rules they won't take effect until the current flows timeout due to inactivity, which is 1 hour. 

[KevinH]

Oh, thank you for the info. I will wait one hour and see if it works.

[PhilipDAth]

I don't believe you will be able to influence which WAN interface particular RADIUS requests are sent from.

What the RaaS should be doing is matching on attributes.

They can match on "NAS Port Type" being WiFi (client VPN does not return a port type).

They can also match on "Called Station ID" which identifies both the AP (not commonly used) and the SSID the user is attempting to authenticate to (client VPN again does not return this).

[KevinH]

@jdsilva I waited 3 hours and it did not work.

@PhilipDAth Thanks for the reply. Unfortunately my Radius service can't match on attributes. They're pretty basic but they have an MFA feature.

I guess I'm out of luck.

[jdsilva]

Yeh sorry @KevinH, Philip is probably correct here. You can likely influence the SSID RADIUS traffic as that's traversing the MX, but for Client VPN it would originate from the MX and not be subject to the flow preferences. I misunderstood that part. Sorry for the confusion.

[KevinH]

"You can likely influence the SSID RADIUS traffic as that's traversing the MX..."

I can test this. As long as I can influence one it should be good enough. Will report back my finding.

[KevinH]

I could not get this to work however Meraki Tech Support said "Flow preferences should be applied to any WAN bound traffic."

Will keep trying.