3

I'm trying to figure out how to setup radius on a Juniper EX2300. The juniper can reach the server no problem, but when I run the 'test aaa authd-lite user [user] password [password]' command, I get the following output:

Authentication Deny
Reason : malformed-request
Test complete. Exiting

After setting up logging, I see the following:

Apr 10 10:34:26.401395 authd_read_msg: Fresh msg arrival. fd=50, hdr_read=0, hdr_remnant=0, payload_read=0 payload_remnant=0
Apr 10 10:34:26.401516 fresh message conn=0x2f35000
Apr 10 10:34:26.401575 read fresh message conn=0x2f35000 hdr_remnant=0 hdr_read=32
Apr 10 10:34:26.401616 Read payload for new message. fd=50, rqst_len=107
Apr 10 10:34:26.401650 Read payload for new message. fd=50, payload_len=75, rqst_len=107, cookie=1
Apr 10 10:34:26.401707 Process/Dispatch Client Message
Apr 10 10:34:26.401748 New Process/Dispatch Client Message
Apr 10 10:34:26.401813 authd_tlv_build_list_from_struct username ([username]) len:6
Apr 10 10:34:26.401869 authd_tlv_build_list_from_struct username l =7 offset =56
Apr 10 10:34:26.401916 authd_tlv_build_list_from_struct profile l =1 offset =63
Apr 10 10:34:26.401963 authd_tlv_build_list_from_struct password (0x111b144) len:9
Apr 10 10:34:26.402006 authd_tlv_build_list_from_struct password l =10 offset =64
Apr 10 10:34:26.402051 authd_auth_aaa_msg_create: num_of_tlvs:1 tot_num_of_tlv:3
Apr 10 10:34:26.402095 authd_auth_aaa_msg_create: aaa-key:len:29:29 acctg_id(lite-test:9266437712586873032)
Apr 10 10:34:26.402130 authd_auth_aaa_msg_create profile:()
Apr 10 10:34:26.402183 Process Request
Apr 10 10:34:26.402286 SEQ RecvClientMsg:CONN2f35000:7 session-id:9266437712586873032 Opcode:1, Subcode:0 (ACCESS_REQUEST)
Apr 10 10:34:26.402427 Creating SubscriberASTEntry for session-id:9266437712586873032, session name:[username]
Apr 10 10:34:26.402494 SubscriberASTEntry: Instantiate/Add Acct-session-id for authd-lite clients Acct-sess-id:lite-test:9266437712586873032Acct-Sess-id length:29
Apr 10 10:34:26.402547 setAccountingInfo:
Apr 10 10:34:26.402588 setAccountingInfo: service accounting order
Apr 10 10:34:26.402709 UserAccess:[username] session-id:9266437712586873032 Access-profile: Multi-Acct-Session-Id:0
Apr 10 10:34:26.402754 authd_auth_modules_pre_feed_sanity: message passed sanity test profile=(), username=(username)
Apr 10 10:34:26.402810 AuthFsm::current state=AuthInit(0) event=1 astEntry=0x117f074 aaa msg=0x106c074
Apr 10 10:34:26.402848 ###################################################################
Apr 10 10:34:26.402881 ########################### AUTH REQ RCVD #########################
Apr 10 10:34:26.402912 ###################################################################
Apr 10 10:34:26.402943 Auth-FSM: Process Auth-Request for session-id:9266437712586873032
Apr 10 10:34:26.403285 Framework: Message failed sanity test - the access-profile info is invalid
Apr 10 10:34:26.403351 SEQ SendClientMsg:CONN2f35000:7 session-id:9266437712586873032 reply-code=5 (MALFORMED REQUEST), result-subopcode=15 (INTERNAL_ERROR), cookie=1, rply_len=28, num_tlv_blocks=0
Apr 10 10:34:26.403531 Delete session-id:9266437712586873032
Apr 10 10:34:26.403635 Begin to logout Subscriber session-id:9266437712586873032
Apr 10 10:34:26.403738 UserAccess:[username] session-id:9266437712586873032 state:log-out  reason: null null
Apr 10 10:34:26.403820 doPersistedDataUpdates
Apr 10 10:34:26.403867 doPersistedDataUpdates
Apr 10 10:34:26.404013 authd_auth_aaa_msg_destroy
Apr 10 10:34:26.404095 authd_auth_aaa_msg_destructauth_aaa_msg: 0x106c074
Apr 10 10:34:26.404139 authd_write_conn: response is 0x2f3505c, total len is 28 and sent is 0
Apr 10 10:34:26.404388 authd_write_conn: response is 0x2f3505c, wrote 28 bytes
Apr 10 10:34:30.404350 authd_read_msg: Fresh msg arrival. fd=50, hdr_read=0, hdr_remnant=0, payload_read=0 payload_remnant=0
Apr 10 10:34:30.404467 fresh message conn=0x2f35000
Apr 10 10:34:30.404524 Reading remnants: premature EOF
Apr 10 10:34:30.404564 authd_conn_terminate: Terminate connection 0x2f35000
Apr 10 10:34:30.404663 clearConnIdTable: Removing all sessions for conn-id:CONN2f35000:7 as the client daemon may be down
Apr 10 10:34:30.404756 Reading remnants, errCode=0

The thing that stands out the msot to me is line about the access-profile being invalid. Coming from a Cisco background, some things in JunOS seem a little strange. I've found 5 different place where I can configure the radius server, ports, and other attributes. I'm not quite sure why they cant be created in one spot, and then referenced everywhere they're needed. Maybe they can, but I currently don't understand.

Below is my current radius config. Can someone tell me what I'm missing here and how this is supposed to work?

system {
    host-name LAB-EX2300-01;
    auto-snapshot;
    time-zone America/Detroit;
    authentication-order [ radius password ];
    root-authentication {
        encrypted-password "$5$6mhl0oZ3$D.GLfc2GmvJI8TLJNzo3ElfawrPP4mWyYOTCjmaZpA/"; ## SECRET-DATA
    }
    name-server {
        192.168.0.161;
        192.168.64.161;
    }
    radius-server {
        172.16.0.16 {
            port 1812;
            accounting-port 1813;
            secret "$9$kmQ3n/COIcAp8XN-g4QFn6p0REyKMLdbzn6/tpM8LXdbgoJ"; ## SECRET-DATA
            retry 3;
            source-address 192.168.60.50;
        }
    }
    login {
        message "*********************************\n*                               *\n* This system is restricted to  *\n* authorized users for business *\n* purposes only.  Unauthorized  *\n* users will be prosecuted.     *\n*                               *\n*********************************";


access-profile RADIUS;

access {
    profile RADIUS {
        authentication-order [ radius password ];
        radius {
            authentication-server 172.16.0.16;
            accounting-server 172.16.0.16;
        }
        radius-server {
            172.16.0.16 {
                port 1812;
                accounting-port 1813;
                secret "$9$IQxhlvM8XVs4xNHqPf6/lKMWNdY2aUjk5QeMW87NjHkq5Q69A"; ## SECRET-DATA
                retry 3;
            }
        }
        accounting {
            order radius;
  • I know this may be an annoying question, but is your JunOS on a supported release? List can be seen here --> kb.juniper.net/InfoCenter/index?page=content&id=KB21476 also is that capture from the Radius or the EX2300 device? – DRP Apr 11 '19 at 4:07
  • Thanks for the reply. I'm currently running Junos: 15.1X53-D58.3, which is what was came on there when we purchased it. All of the out above is from the EX2300 – DragonFist616 Apr 12 '19 at 13:28
  • 1
    Unrelated to your question, but do yourself a favour and upgrade to 15.1X53D59 as soon as you can - there are some RADIUS-specific bugs in D58 – Benjamin Dale Apr 13 '19 at 12:54
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 1:45
2

I ended up figuring out what my issue was. I didn't have a remote user setup under [system login]. Once i create that and specified the permissions level i was able to get radius to work just fine.

This is what I added:

system {
   login {
       user remote {
           uid 2001;
           class super-user;
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.