1

Let me start by putting my issue into one sentence:

I have a Catalyst 4507 and I can't log onto it using RADIUS even though the configuration is the same as a Catalyst 3850 which is working and testing RADIUS using the IOS-XE tests in the 4507 is successful. What could be the problem?

I successfully configured a Catalyst 3850 to use a Windows Server 2008 R2 NPS server for RADIUS. I mostly replicated that configuration on a Catalyst 4507 (adjusted for platform differences) and when I run test aaa group on the 4507, the test succeeds. When I try to actually log on to the 4507 with an account that needs RADIUS to authenticate, it fails. It looks like the failure on logon is a timeout contacting the RADIUS server, but I can't figure out why the authentication request would work differently between the test and the actual logon.

Here's some config, test, and output:

Config

Version:

#show ver
Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch  Software
 (cat4500es8-UNIVERSALK9-M), Version 03.08.02.E RELEASE SOFTWARE (fc2)

Management Interface (from which RADIUS requests must be sent):

!
interface FastEthernet1
 vrf forwarding mgmtVrf
 ip address yy.yy.yy.yy 255.255.255.0
 speed auto
 duplex auto
!

AAA Config:

#show run aaa
!
aaa authentication login default local group radius
aaa authorization exec default local group radius
aaa accounting exec default start-stop group radius
aaa accounting delay-start
username XXXX privilege 15 secret 5 XXXX
!
!
radius server NPSSERVER
 address ipv4 xx.xx.xx.xx auth-port 1645 acct-port 1646
 key 7 XXXX
!
!
aaa group server radius RADIUSGROUP
 server name NPSSERVER
 ip vrf forwarding mgmtVrf
 ip radius source-interface FastEthernet1
!
!
aaa new-model
aaa session-id common
!

Tests

Cleared counters:

#show aaa servers

RADIUS: id 1, priority 1, host xx.xx.xx.xx, auth-port 1645, acct-port 1646
 State: current UP, duration 2157s, previous duration 0s
 Dead: total time 0s, count 13
 Quarantined: No
 Authen: request 0, timeouts 0, failover 0, retransmission 0
         Response: accept 0, reject 0, challenge 0
         Response: unexpected 0, server error 0, incorrect 0, time 0ms
         Transaction: success 0, failure 0
         Throttled: transaction 0, timeout 0, failure 0

RADIUS Test and Counters:

#test aaa group RADIUSGROUP username@domain.com XXXXXX new-code

User successfully authenticated

USER ATTRIBUTES

service-type         0   7 [NAS Prompt]
priv-lvl             0   15 (0xF)

#show aaa servers

RADIUS: id 1, priority 1, host xx.xx.xx.xx, auth-port 1645, acct-port 1646
 State: current UP, duration 2278s, previous duration 0s
 Dead: total time 0s, count 13
 Quarantined: No
 Authen: request 1, timeouts 0, failover 0, retransmission 0
         Response: accept 1, reject 0, challenge 0
         Response: unexpected 0, server error 0, incorrect 0, time 4ms
         Transaction: success 1, failure 0
         Throttled: transaction 0, timeout 0, failure 0

Login Attempt and Counters:

login as: username@domain.com
Using keyboard-interactive authentication.
Password:
Access denied


#show aaa servers

RADIUS: id 1, priority 1, host xx.xx.xx.xx, auth-port 1645, acct-port 1646
 State: current UP, duration 2436s, previous duration 0s
 Dead: total time 0s, count 13
 Quarantined: No
 Authen: request 5, timeouts 4, failover 0, retransmission 3
         Response: accept 1, reject 0, challenge 0
         Response: unexpected 0, server error 0, incorrect 0, time 4ms
         Transaction: success 1, failure 1
         Throttled: transaction 0, timeout 0, failure 0

Here's the output from debug aaa authentication during a failed logon attempt:

*Dec  2 19:35:48.817: AAA/BIND(00000041): Bind i/f
*Dec  2 19:35:48.817: AAA/AUTHEN/LOGIN (00000041): Pick method list 'default'
*Dec  2 19:36:02.322: %RADIUS-4-RADIUS_DEAD: RADIUS server x.x.x.x:1645,1646 is not responding.
*Dec  2 19:36:02.322: %RADIUS-4-RADIUS_ALIVE: RADIUS server x.x.x.x:1645,1646 is being marked alive.
*Dec  2 19:36:14.379: AAA/AUTHEN/LOGIN (00000041): Pick method list 'default'

The logs on the NPS servers are pretty difficult to read, but I'm pretty sure they show success when I log on from the working switch, success when I test from the 4507, and no connection at all when I attempt to log on to the 4507.

(Mostly) Complete config:

version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service compress-config
!
hostname REDACTED
!
boot-start-marker
boot system flash bootflash:cat4500es8-universalk9.SPA.03.08.02.E.152-4.E2.bin
boot-end-marker
!
!
vrf definition mgmtVrf
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
enable secret 5 REDACTED
!
username REDACTED privilege 15 secret 5 REDACTED
aaa new-model
!
!
aaa group server radius RADIUSGROUP
 server name RADIUSSERVER
 ip vrf forwarding mgmtVrf
 ip radius source-interface FastEthernet1
!
aaa authentication login default local group radius
aaa authorization exec default local group radius 
aaa accounting delay-start
aaa accounting exec default start-stop group radius
!
!
aaa session-id common
clock timezone UTC -5 0
clock summer-time EDT recurring
!
!
udld enable
!
!
ip domain-name domain.com
ip name-server REDACTED
ip name-server REDACTED
!
!
power redundancy-mode redundant
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
spanning-tree uplinkfast
spanning-tree backbonefast
!
redundancy
 mode sso
!
vlan internal allocation policy ascending
!
! ******* Port-channel interfaces redacted
!
interface FastEthernet1
 vrf forwarding mgmtVrf
 ip address x.x.x.x 255.255.255.0
 speed auto
 duplex auto
!
! ******** Line card interfaces redacted
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan10
 description REDACTED
 ip address REDACTED
 ip helper-address REDACTED 
 no ip redirects
!
interface Vlan11
 description REDACTED
 ip address REDACTED
 ip helper-address REDACTED
 no ip redirects
!
interface Vlan20
 description REDACTED
 ip address REDACTED
 ip helper-address REDACTED
 no ip redirects
!
interface Vlan23
 description REDACTED
 ip address REDACTED
 ip helper-address REDACTED
 no ip redirects
!
interface Vlan24
 description REDACTED
 ip address REDACTED
 ip helper-address REDACTED
 no ip redirects
!
interface Vlan28
 description REDACTED
 ip address REDACTED
 ip helper-address REDACTED
 no ip redirects
!
interface Vlan29
 description REDACTED
 ip address REDACTED
 ip helper-address REDACTED
 no ip redirects
!
interface Vlan30
 description REDACTED
 ip address REDACTED
 ip helper-address REDACTED
 no ip redirects
!
interface Vlan40
 description REDACTED
 ip address REDACTED
 ip helper-address REDACTED
 no ip redirects
!
interface Vlan60
 description REDACTED
 ip address REDACTED
 ip helper-address REDACTED
 no ip redirects
!
interface Vlan100
 description REDACTED
 ip address REDACTED
 ip helper-address REDACTED
 no ip redirects
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 REDACTED
ip route vrf mgmtVrf 0.0.0.0 0.0.0.0 REDACTED
ip ssh version 2
!
ip access-list extended snmp-access
 permit ip host REDACTED any
!
ip radius source-interface FastEthernet1 
!
snmp-server community public RO
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps tty
snmp-server enable traps cpu threshold
snmp-server enable traps fru-ctrl
snmp-server enable traps entity
snmp-server enable traps flash insertion removal
snmp-server enable traps vlancreate
snmp-server enable traps vlandelete
snmp-server enable traps envmon fan shutdown supply temperature status
snmp-server enable traps port-security
snmp-server enable traps config
snmp-server enable traps syslog
snmp-server enable traps vlan-membership
!
!
radius server RADIUSSERVER
 address ipv4 REDACTED auth-port 1645 acct-port 1646
 key 7 REDACTED
!
!
!
!
line con 0
 logging synchronous
 stopbits 1
line vty 0 4
 exec-timeout 15 0
line vty 5 15
!
ntp server REDACTED
ntp server REDACTED
!
end
  • You really shouldn't be using a physical interface as the source address for RADIUS. You should be using a logical interface that never goes down, e.g. loopback for a router or layer-3 switch, or an SVI for a layer-2 switch. That makes sure that the source address will always be the same, regardless of the path or interface status. You haven't even included the interface configuration to see if it even has a layer-3 address configured. – Ron Maupin Dec 2 '16 at 17:32
  • @RonMaupin Is that a best practices comment or a possible solution to my problem comment? I'm not sure I understand the comment as it is - but I will add the interface config. It's the management interface with its own VRF (hence the VRF commands in the RADIUS group config). I used a Cisco programming guide for this (combined with successfully configuring RADIUS several times in the past) and this is close to verbatim of the Cisco guide. – Todd Wilcox Dec 2 '16 at 17:36
  • It's a best practice comment. If the interface goes down, especially if you use it for switch management, you can run into problems, even if you have other paths to the switch. If you use a logical interface that never goes down, and you have multiple paths to the switch, then you avoid the problems, and the switch can still be managed. It is really better to include the entire switch configuration in your question because there are other configurations that can affect your problem. Obfuscate public addresses and passwords, but don't worry about private addresses being seen. – Ron Maupin Dec 2 '16 at 17:41
  • @RonMaupin Uhh.. and I assume omit all but the relevant interface configs? It's a 4507 with four line cards in it so the config is pretty huge. I'll have to try to set up TFTP so I can get the whole config without 400 copy and paste actions. Please be patient. – Todd Wilcox Dec 2 '16 at 17:42
  • The Preformatted Text feature will create a scroll box for long or wide configurations. The only limit is 30,000 characters in your question. – Ron Maupin Dec 2 '16 at 17:43
3

The mistake/oversight in my config is here:

aaa authentication login default local group radius

Using the radius keyword at the end instead of the explicit name of the RADIUS group defined elsewhere means the AAA system does not correctly use that RADIUS group. The correct AAA configuration command is this:

aaa authentication login default local group RADIUSGROUPNAME

Where RADIUSGROUPNAME matches with the keyword chosen in the first line of the following configuration commands:

aaa group server radius RADIUSGROUPNAME
 server name NPSSERVER
 ip vrf forwarding mgmtVrf
 ip radius source-interface FastEthernet1

The reason why the test was successful is because I was specifying the RADIUS group name in the test, like so:

#test aaa group RADIUSGROUPNAME username@domain.com XXXXXX new-code

Running the test as follows would fail:

#test aaa group radius username@domain.com XXXXXX new-code
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.