VIP Enterprise Gateway Validation Server fails with error: Can't get Message-Authenticator attribute

Products

• VIP Service

Issue/Introduction

Validation requests fail with:

ERROR "2024-07-15 16:32:01.170 GMT0000" 10.2.3.4 Netscaler:1812 0 0 "text=VSValidationPacketizerProcess() -- Can't get Message-Authenticator attribute" Thread-10024 VSValidationPacketizer.cpp
ERROR "2024-07-15 16:32:01.170 GMT0000" 10.2.3.4 Netscaler:1812 0 0 "text=VSValidationServer._sendResponse()  -- Message-Authenticator attribute is either missing or invalid. Discarding the request." Thread-10024 VSValidationServer.cpp

Cause

When the Enterprise Gateway Validation Server setting for Radius Packet Security Mode: is set to Compliant, it expects incoming RADIUS requests to contain the message-authenticator attribute in the packet (Message-Authenticator attribute is used to sign/validate the integrity of the packet). If missing, the Validation Server discards the packet and the transaction silently fails. 

Resolution

Switching to Compatible mode allows the Validation Server to process RADIUS authentication requests when the message-authenticator attribute is missing. 

If the error occurs while using any VIP plugin or integration module, upgrade to the latest version.

IMPORTANT: Using Compatible mode is not recommended as it bypasses protections that mitigate "Blast-RADIUS" security vulnerabilities. Contact your RADIUS client vendor to provide updated software that utilizes the message-authenticator RADIUS attribute. Compliant mode requires the RADIUS request to include the Message-Authenticator attribute.