Radius authentication through management interface fails

ms.america · Created Apr 24, 2017 01:21:04

1. Firstly it will be necessary to check if the radius server is reachable from the CE switch. Ping from radius server to Meth0/0/0 interface IP and reverse is successful.

2. The next step is to perform a debugging for aaa system while user is trying to connect to system by ssh.

Open debugging
< R7_U18_CE6850> debugging radius all
< R7_U18_CE6850>t d
Info: Current terminal debugging is on.
< R7_U18_CE6850>t m
Info: Current terminal monitor is on.
…
Try to connect by ssh/stelnet
Collect the debugging.

At this step, the system was not returning any kind of output unless customer was trying to access the system with a local user. Remote users defined into radius didn't enable any kind of output.

Root Cause

Since the aaa didn't trigger any kind of logging for remote radius defined users I reviewed again the SSH configuration. It looks like customer defined only on user locally into the system.

ssh user admin
ssh user admin authentication-type all
ssh user admin service-type all
ssh authorization-type default aaa

For this user the authentication succeed.

Solution

Of course, defining all users locally into CE switch is not scalable, but using “ssh authentication-type default password” system will allow radius authentication for all users that uses SSH connection .

Solution:

# Configure the password authentication mode for an SSH user.
< HUAWEI> system-view
[~HUAWEI] ssh authentication-type default password

Enterprise

Consumer

Corporate

Carriers

Radius authentication through management interface fails

Third Party’s Trade Secret