0

I have multiple cisco switches like Nexus family and IOS family switches and now i am trying to configure centralized authentication so i have install Freeradius and freeIPA (ldap server)

I have created two group net-admin and net-operator (read-only view) in LDAP and map then in freeradius in file /etc/raddb/user

# Cisco ldap group def:
#
DEFAULT  ldap1-Ldap-Group == "cn=net-admin,cn=groups,cn=compat,dc=example,dc=com"
         Service-Type = Administrative-User,
         Service-Type = Login-User,
         Service-Type = NAS-Prompt-User,
         Cisco-AVPair = "shell:roles=network-admin",
         Cisco-AVPair += "shell:priv-lvl=15"

DEFAULT  ldap1-Ldap-Group == "cn=net-operator,cn=groups,cn=compat,dc=example,dc=com"
         Service-Type = Administrative-User,
         Service-Type = Login-User,
         Service-Type = NAS-Prompt-User,
         Cisco-AVPair = "shell:roles=net-operator",
         Cisco-AVPair += "shell:priv-lvl=1"

Configured all cisco nexus switches aaa for radius and everything working great!

now comes to Cisco 2960 switches which is behaving very odd, I have configured following. 

aaa new-model
!
!
aaa authentication login default group radius local
aaa authorization exec default local
aaa authorization network default local
!
radius-server host 10.10.10.25 auth-port 1812 acct-port 1813 key Secret123

When i try to login on cisco 2960 switch it failed so i have create just local account to see if it works or not so i did following

2960(config)# username spatel password foo

now i am able to login on cisco 2960 switch using my LDAP password not foo so question is why Cisco 2960 not looking into LDAP account instead looking at local ?

Improve this question

1 Answer 1

Reset to default
4

This line:

aaa authorization exec default local

Doesn't allow you to start a shell (Exec) with Radius credentials. You should change it to:

aaa authorization exec default group radius local
Improve this answer
4
  • Nice! it works but now my users directly get # exec shell, how do i make them have limited privilege like only read-only or show only?
    – Satish
    Commented Dec 13, 2019 at 18:18
  • You need command authorization for that. TACACS is a better fit to do that kind of control.
    – Ron Trunk
    Commented Dec 13, 2019 at 18:20
  • can't we define privileges on cisco switch and map priv-lvl in radius?
    – Satish
    Commented Dec 13, 2019 at 18:23
  • nevermind, its working now, i am able to map privileges, my problem was i specified multiple Service-Type in radius and that was the issue. after removing them it works
    – Satish
    Commented Dec 13, 2019 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.