Take the 2-minute tour ×
Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

I am configuring RADIUS authentication on my switches but it does not work and I don't know why.

My configuration is pretty straightforward :

aaa new-model
aaa group server radius RADIUS-ACTIF
  server x.x.x.x auth-port 1812 acct-port 1813
  server y.y.y.y auth-port 1812 acct-port 1813
  ip radius source-interface Vlan10
  deadtime 1
aaa authentication attempts login 5
aaa authentication password-prompt Secured-Password:
aaa authentication username-prompt Secured-Username:
aaa authentication login default local
aaa authentication login RADIUS-ACTIF group RADIUS-ACTIF local
aaa authentication enable default enable
aaa authorization exec default group RADIUS-ACTIF local
aaa session-id common

line vty 0 4
    login authentication RADIUS-ACTIF

The thing is : I can't see anything happening on the "Failed Attempts" on my ACS Server. There are no logs of my attempts at authentication.

ACS server is reachable via ping from my switches. I have tried to test the RADIUS access with the test command : I get the User rejected feedback after less than 2/3 seconds, so I am thinking that I can access the RADIUS but I get blocked even before submitting my credentials. It's a very strange behavior.

Does anybody has an idea as to why this would happen?

I should also say that the exact same configuration is working on one switch (on a different IP plan though.

Thanks

share|improve this question
1  
Did you add the router has client on the ACS? Did you set the key on the router? –  radtrentasei Apr 18 at 10:45
    
There is no key exchange between router & ACS (unlike if I had used TACACS.) My router is a client on the RADIUS server though, with vlan 10 IP. –  Jeremy G. Apr 18 at 10:56
2  
I'm referring to the pre-shared key. –  radtrentasei Apr 18 at 11:11
1  
Oh dear. I am such an idiot. I forgot to set the PSK. Thank you very much for pointing it out to me, I could have gone hours before realizing it. –  Jeremy G. Apr 18 at 11:15

1 Answer 1

up vote 4 down vote accepted

According to my experience the two most common issues when dealing with AAA and Radius are:

  • Misspelled/Absent pre-shared key on the RADIUS server or on the NAC (Radius client)
  • The Radius server misses the configuration to allow requests from a client.

Doing troubleshooting with comments it turned out that the pre-shared key was missing on the router.

To add this just type:

(config)#radius-server host x.x.x.x auth-port 1812 acct-port 1813 key ***

or (to define a default key):

(config)#radius-server key ***

If you are interested in a more general method for troubleshooting refere here: Troubleshooting RADIUS and TACACS+

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.