Switch connectivity problem with Radius server

Created Jan 01, 2016 03:09:57Latest reply Jan 04, 2016 10:41:20 1065 1 0 0

Problem: The switch(CE 6850) is not sending radius packets to Radius server. Ping results are positive from both sides.

Solution:

The log on switch process was made using SSH with Radius authentication, but process was failing every time.

From tcpdump results no udp packets containing radius information were exchanged between switch and radius server.

   =>the output from "display aaa online-fail-recard"  was: Online fail reason: server retun fail

    =>from "debugging ssh server all" output resulted that the authentication was not passing the SSH -AAA process, which resulted in failure, thefore no radius request packets was sent to Radius server.

Oct 15 2015 08:10:55...
> |sender      :SSHS
> |receive     :AAA

> |intf        :INTF_SMP
> |sub_intf    :SMP_SUB_INTF_AAAI
> |transno     :3
> |type        :AUTHEN
> |VS_ID       :0
> |APPHANDLE   :135182
> |AUTHEN_TYPE :PASSWORD
> |USER_NAME   :test
> |ACC_TYPE    :ssh
> |PORT_TYPE   :16
> |IPV4_ADDR   :192.168.1.2
> |Line index  :0
> |LEVEL       :65535
> |TEI         :0
> |RESULT      :Server return fail
> |VPN_ID      :0
> |PASSWORD    :******

> Oct 15 2015 08:10:55 ...
> |sender      :AAA
> |receive     :SSHS

> |intf        :INTF_SMP
> |sub_intf    :SMP_SUB_INTF_AAAI
> |transno     :3
> |type        :AUTHEN
> |VS_ID       :0
> |APPHANDLE   :135182
> |RESULT      :Server return fail
> |DELAY_TIME  :5
> |USER_NAME   :test
> |TEI         :33554432

      =>the problem was solved by implementing into configuration the command: ssh authentication-type default password

> Oct 16 2015 12:44...
> |sender      :AAA
> |receive     :RDS

> |intf        :INTF_SMP
> |sub_intf    :SMP_SUB_INTF_AAAI
> |transno     :5
> |type        :AUTHEN
> |VS_ID       :0
> |APPHANDLE   :135188
> |USER_NAME   :test
> |DomainName  :default_admin
> |PureUserName:test
> |ACC_TYPE    :ssh
> |PORT_TYPE   :16
> |TEI         :33554432
> |AUTHEN_TYPE :PASSWORD
> |PASSWORD    :******
> |SESSION_ID  :29
> |TIME_OUT    :55
> |TMP_ID      :1
> |RmtSvrType  :6
> |FramedProto :6
> |IPV4_ADDR   :192.168.2.2

> Oct 16 2015 12:44...
> |sender      :RDS
> |receive     :AAA

> |intf        :INTF_SMP
> |sub_intf    :SMP_SUB_INTF_AAAI
> |transno     :5
> |type        :AUTHEN
> |VS_ID       :0
> |APPHANDLE   :135188
> |SESSION_ID  :29
> |SendServer  :0

When a Radius server is used for authentication and a user uses SSH to access the server, the network administrator must specify the SSH user on the server for authentication. In most cases, the SSH server cannot obtain the user information on the Radius server. When the user information on the Radius server cannot be obtained, you can configure this command to set the authentication mode to password. After the setting, SSH users can directly log in to the device without additional SSH user configurations on the device.

  • x
  • convention:

user_2790689  Expert   Created Jan 04, 2016 10:41:20 Helpful(0) Helpful(0)

Thank you.
  • x
  • convention:

Responses

Reply
You need to log in to reply to the post Login | Register

Notice:To ensure the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but not limited to politically sensitive content, content concerning pornography, gambling, drug abuse and trafficking, content that may disclose or infringe upon others' intellectual properties, including commercial secrets, trade marks, copyrights, and patents, and personal privacy. Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see“ Privacy Policy.”
If the attachment button is not available, update the Adobe Flash Player to the latest version!
Fast reply Scroll to top