Fault Symptom
The RADIUS server is used to authenticate access users and implement accounting for access users. In addition, the authentication mode for upgrading the user level in an authentication scheme is set to super.
After a user runs the super command and enters the super password, the message aaa cut user is displayed on the router. The user fails the authentication.
Fault Analysis
1. The super password is statically configured on the router and is by no means invalid. The following information is displayed in the logs on the router:
RDS/4/RDACCTDOWN: RADIUS accounting server (IP:10.1.1.1) is down!
The preceding information indicates that the communication between the RADIUS accounting server and the router is interrupted, but the RADIUS authentication server communicates normally with the router.
2. After the display this command is run in the AAA view of the router, the AAA configurations are displayed as follows:
accounting-scheme default
accounting-mode RADIUS
The preceding information indicates that the RADIUS accounting mode is adopted. It is inferred that the communication between the RADIUS accounting server and the router is interrupted and thus an accounting failure occurs. As a result, the router is logged out. It is suspected that the RADIUS accounting server is disabled or faulty or the link is faulty.
Procedure
1. Check whether the RADIUS accounting server is disabled or faulty. If so, restore the RADIUS server.
2. Check whether the link works properly. If so, restore the link.
After the preceding operations, the user can pass the authentication after entering the super password. The fault is rectified.
Summary
User management includes authentication, authorization, and accounting.
You should consider authentication, authorization, and accounting in a comprehensive manner when configuring AAA. A user cannot pass the authentication if failing any one of the operations.
