4

I am configuring RADIUS authentication on my switches but it does not work and I don't know why.

My configuration is pretty straightforward : 

aaa new-model
aaa group server radius RADIUS-ACTIF
  server x.x.x.x auth-port 1812 acct-port 1813
  server y.y.y.y auth-port 1812 acct-port 1813
  ip radius source-interface Vlan10
  deadtime 1
aaa authentication attempts login 5
aaa authentication password-prompt Secured-Password:
aaa authentication username-prompt Secured-Username:
aaa authentication login default local
aaa authentication login RADIUS-ACTIF group RADIUS-ACTIF local
aaa authentication enable default enable
aaa authorization exec default group RADIUS-ACTIF local
aaa session-id common

line vty 0 4
    login authentication RADIUS-ACTIF

The thing is : I can't see anything happening on the "Failed Attempts" on my ACS Server. There are no logs of my attempts at authentication.

ACS server is reachable via ping from my switches. I have tried to test the RADIUS access with the test command : I get the User rejected feedback after less than 2/3 seconds, so I am thinking that I can access the RADIUS but I get blocked even before submitting my credentials. It's a very strange behavior.

Does anybody has an idea as to why this would happen?

I should also say that the exact same configuration is working on one switch (on a different IP plan though.

Thanks

Improve this question
4
  • 1
    Did you add the router has client on the ACS? Did you set the key on the router?
    – radtrentasei
    Commented Apr 18, 2014 at 10:45
  • There is no key exchange between router & ACS (unlike if I had used TACACS.) My router is a client on the RADIUS server though, with vlan 10 IP.
    – Jeremy G.
    Commented Apr 18, 2014 at 10:56
  • 2
    I'm referring to the pre-shared key.
    – radtrentasei
    Commented Apr 18, 2014 at 11:11
  • 1
    Oh dear. I am such an idiot. I forgot to set the PSK. Thank you very much for pointing it out to me, I could have gone hours before realizing it.
    – Jeremy G.
    Commented Apr 18, 2014 at 11:15

1 Answer 1

Reset to default
5

According to my experience the two most common issues when dealing with AAA and Radius are:

  • Misspelled/Absent pre-shared key on the RADIUS server or on the NAC (Radius client)
  • The Radius server misses the configuration to allow requests from a client.

Doing troubleshooting with comments it turned out that the pre-shared key was missing on the router.

To add this just type:

(config)#radius-server host x.x.x.x auth-port 1812 acct-port 1813 key ***

or (to define a default key):

(config)#radius-server key ***

If you are interested in a more general method for troubleshooting refere here: Troubleshooting RADIUS and TACACS+

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.