Problem: The switch(CE 6850) is not sending radius packets to Radius server. Ping results are positive from both sides.
Solution:
The log on switch process was made using SSH with Radius authentication, but process was failing every time.
From tcpdump results no udp packets containing radius information were exchanged between switch and radius server.
=>the output from "display aaa online-fail-recard" was: Online fail reason: server retun fail
=>from "debugging ssh server all" output resulted that the authentication was not passing the SSH -AAA process, which resulted in failure, thefore no radius request packets was sent to Radius server.
Oct 15 2015 08:10:55...
> |sender :SSHS
> |receive :AAA
> |intf :INTF_SMP
> |sub_intf :SMP_SUB_INTF_AAAI
> |transno :3
> |type :AUTHEN
> |VS_ID :0
> |APPHANDLE :135182
> |AUTHEN_TYPE :PASSWORD
> |USER_NAME :test
> |ACC_TYPE :ssh
> |PORT_TYPE :16
> |IPV4_ADDR :192.168.1.2
> |Line index :0
> |LEVEL :65535
> |TEI :0
> |RESULT :Server return fail
> |VPN_ID :0
> |PASSWORD :******
>
> Oct 15 2015 08:10:55 ...
> |sender :AAA
> |receive :SSHS
> |intf :INTF_SMP
> |sub_intf :SMP_SUB_INTF_AAAI
> |transno :3
> |type :AUTHEN
> |VS_ID :0
> |APPHANDLE :135182
> |RESULT :Server return fail
> |DELAY_TIME :5
> |USER_NAME :test
> |TEI :33554432
=>the problem was solved by implementing into configuration the command: ssh authentication-type default password
> Oct 16 2015 12:44...
> |sender :AAA
> |receive :RDS
> |intf :INTF_SMP
> |sub_intf :SMP_SUB_INTF_AAAI
> |transno :5
> |type :AUTHEN
> |VS_ID :0
> |APPHANDLE :135188
> |USER_NAME :test
> |DomainName :default_admin
> |PureUserName:test
> |ACC_TYPE :ssh
> |PORT_TYPE :16
> |TEI :33554432
> |AUTHEN_TYPE :PASSWORD
> |PASSWORD :******
> |SESSION_ID :29
> |TIME_OUT :55
> |TMP_ID :1
> |RmtSvrType :6
> |FramedProto :6
> |IPV4_ADDR :192.168.2.2
>
> Oct 16 2015 12:44...
> |sender :RDS
> |receive :AAA
> |intf :INTF_SMP
> |sub_intf :SMP_SUB_INTF_AAAI
> |transno :5
> |type :AUTHEN
> |VS_ID :0
> |APPHANDLE :135188
> |SESSION_ID :29
> |SendServer :0
When a Radius server is used for authentication and a user uses SSH to access the server, the network administrator must specify the SSH user on the server for authentication. In most cases, the SSH server cannot obtain the user information on the Radius server. When the user information on the Radius server cannot be obtained, you can configure this command to set the authentication mode to password. After the setting, SSH users can directly log in to the device without additional SSH user configurations on the device.
