Problem with Entra/RADIUS NPS addon after KB5040430 install

Question

Hello,

We have a firewall which use RADIUS authentication with Entra/Azure NSP addon. We use this solution to VPN service in our company. We installed the latest commulative update (KB5040430) one of NPS server yesterday. Today, we can't connect to our VPN service. We checked the event log on NPS server and in our Azure tenan, but that wrote everything fine, nevertheless the VPN connection doesn't work. When we change the NPS server to other, which doesn't contain the latest commulative update (KB5040430), the connections work fine.

I didn't find known issues, or solution on MS sites, but in this Reddit post has simmilar issue (without solutions and workarounds.)

• Patch Tuesday Megathread (2024-07-09) : r/sysadmin (reddit.com)

Do you have any idea about our problems?

Thanks,

Gabor

Answer 1

Whose firewall solution is being used?
Both Checkpoint and Sophos appear to be investigating interop issues with RADIUS protections in the July 9, 2024 Windows Updates discussed in:

• KB5040268: How to manage the Access-Request packets attack vulnerability associated with CVE-2024-3596
• CVE-2024-3596: RADIUS Protocol Spoofing Vulnerability
• RADIUS/UDP Considered Harmful

If using Checkpoint firewalls, see

Solved: Re: Blast-RADIUS - CVE-2024-3596 - Page 3 - Check Point CheckMates

• CheckPoint Solution ID: sk182516: Check Point response to CVE-2024-3596 - Blast-RADIUS attack
  • Check Point plans to provide a fix in the upcoming Jumbo Hotfix Accumulator package for all supported versions.
• Checkpoint Solution ID: sk42184: RADIUS authentication fails

If using Sophos firewalls, see

• IPSEC/L2TP with Radius and CVE-2024-3596 - Discussions - Sophos Firewall - Sophos Community

Answer 2

Hello,

First, you could try uninstalling the update and see if that resolves the issue. To do this, go to Settings > Update & Security > Windows Update > View update history > Uninstall updates. Find the update in question and click Uninstall.

I hope the above information can help you.

Best regards

Zunhui

Answer 3

Hello Zunhui,

First of all, thank you for your answer, I appreciate for your help! This cummulative patch contains a lot of security fix. Surely the right way is to delete the patch on the affected server? Does the Microsoft know that the this patch cause problems on the NPS servers?

Thank you for your help!

Best regards,

Gabor

Answer 4

Hi Kovács Gábor_000,

Microsoft usually pays attention to user feedback. If there is already user feedback on this issue, it should be aware of it and will fix it in a subsequent update.

Best regards

Zunhui

Answer 5

Hello Zunhui,

Thank you for your feedback! We removed the update (KB5040430) from the server. The RADIUS / Entra NPS addon works fine.

We waiting for the next cumulative update which contains the fix. If you have any update about this, you able to give feedback?

I appreciate your help!

Best Regard,

Gabor Kovacs