Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BlastRadius mitigations causing multiple events when 'requiremsgauth' flag is set for Remote Servers #10

Open
andrew-fitzgerald opened this issue Aug 13, 2024 · 1 comment
Labels

Comments

@andrew-fitzgerald
Copy link

Event Code 4420
EVENT: The RADIUS Proxy received a response from server 127.0.0.1 with a missing Message-Authenticator attribute. Response is currently allowed since the requireMsgAuth is configured in Audit mode. See https://support.microsoft.com/help/5040268 to learn more.
EVENT DESCRIPTION:
This is an Audit event for RADIUS response packets received without the Message-Authenticator attribute at the proxy. Consider changing the specified RADIUS server for the Message-Authenticator attribute. The RADIUS packet will be dropped once the requiremsgauth configuration is enabled.

The above event fires when the PAN-RA proxy RADIUS Remote Server has the attribute 'requiremsgauth' enabled

Workaround includes adding the PANRRA proxy from Remote Servers to the exception list which will stop the events from firing.

Copy link

stale bot commented Oct 17, 2024

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs.

@stale stale bot added the stale label Oct 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants