This is regarding a case I had with testing the RADIUS AAA on an S5700 Switch. I had configured an Agile Controller as the RADIUS Server on the Switch. In the Agile Controller, an Active Directory (AD) Server was already synchronized so that the AD users on the Agile Controller can be found by going to Resources > User Management.
Upon finishing the configuration of RADIUS AAA and on the Switch, I proceeded to test it on the Switch CLI using the following command:
<master switch> sys
[master switch] test-aaa <AD account username> <password> radius-template <template name> pap
Info: Account test succeeded
Note that when using the test-aaa command and testing with a synchronized AD account, the PAP protocol is used as the CHAP (which is the default when no protocol is stated) will fail. Also check the Agile Controller for the RADIUS login attempt after using this command so as to assure that the Agile Controller is being used a RADIUS Server for authentication. The RADIUS logs can be found by going to Resources > RADIUS Logs. Should there be any error, these logs can provide an even more detailed error message as resolution for each individual error message can vary.
Seeing that the test is successful, I then proceeded to try to log on to the Switch through SSH using the AD account but then got the following result.
login as: <AD account username>
SSH server: User Authentication
Using keyboard-interactive authentication.
Password: <password>
Access denied
After seeing the that the login through SSH has failed, I checked the Agile Controller for a RADIUS log pertaining to my failed login attempt but found none.
Although no logs or detailed error messages were found on the Agile Controller, the solution for this particular case was pretty simple. Executing the following command on the Switch CLI allowed for a successful authentication via SSH:
[master switch] ssh user <AD account username> authentication-type password
[master switch] ssh user <AD account username> service-type all
This command will allow the AD account specified to gain access to the Switch CLI via SSH. Do note that this command should be executed for every Agile Controller account that wishes to gain access to the Switch CLI via SSH.
