I have set up a Radius server (v. 4.15 16 april 2003) on NW65sp2 server
and I'm trying to use it to authenticate to a Watchguard Firebox II
firewall. The authentication functions but apparently the firewall is
not getting (or not parsing) the Filter-Id information to assign access
rights via groups. When I login to the firewall with "user1", the
response is "Authenticationsucceeded, but no access grantedfor user". If
I define "user1" on the firewall and assign it to an access policy, then
everything works. But if I define an access group "group1" and assign
it to an access policy on the firewall and then assign "group1" to the
eDir Access Profile object that is assigned to "user1", (Filter-Id =
group1) I get the above authentication succesful, but no access granted.
Is there a way to identify exactly what information is being sent from
the Radius server to the access device so I can determine if the problem
is on the Novell Radius server side or the Watchguard Firewall side?
I've activated the Radius Debug Log, but that only tells me that it
finds all the relevant objects in eDirectory and that authentication is
successfull, but there is no indication that any other information is
being sent to the access device.

As I understand it, the filer-id's are supposed to allow a link between
the eDir user objects and what access rights are allowed on the access
device (firewall). Essentially this is how I define group memberships on
the firewall using eDir user. Is this assumption correct?

The goal of course is to allow access over the firewall without having
to type in 500 user names on the firewall.

Any ideas or tips on what I could check or configure differently would
be helpful. thanks

bill reading