topic Cisco ACS Radius configuration in Network Access Control

Cisco ACS Radius configuration

zafar_118 — Mon, 11 Mar 2019 03:53:28 GMT

Hello,

I am trying to configure radius authentication on cisco ACS but running into issue. When i configure my Network Device Group in AAA Client setup to be one of radius device groups, my authentications are failing with authentication failure code as "

CS password invalid" but when i change my Network Device Group to "Not Assigned", everything starts working.

On my AAA client, when authentication are failing, i am seeing

packet from RADIUS server <ip address> fails verification:

Please note that AAA client is a non cisco device.

Any suggestions?

Cisco ACS Radius configuration

Naveen Kumar — Thu, 12 Sep 2013 04:30:57 GMT

Which ACS version you are using?

ACS 4.0 is having this problem, If you are using the same, please update and try.

Re: Cisco ACS Radius configuration

Jatin Katyal — Thu, 12 Sep 2013 09:34:48 GMT

It seems you're running ACS 4.x. You're facing this issues because the key defined on the NDG level (XYZ network device group in your case) over-rides the key at the AAA client level. Please make sure that you don't have different secret key on the AAA client inside the NDG and on the NDG itself.

Not assigned is working because there is no key defined in that NDG.

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/NetCfg.html#wp342738

"Each device that is assigned to the Network Device Group will use the shared key that you enter here. The key that was assigned to the device when it was added to the system is ignored. If the key entry is null, the AAA client key is used."

~BR
Jatin Katyal

**Do rate helpful posts**

Cisco ACS Radius configuration

zafar_118 — Thu, 12 Sep 2013 13:39:47 GMT

Hi Nkumarsr,

It is infact ACS v4.0. Is there any cisco bug/document related to this issue?

Thanks

Cisco ACS Radius configuration

zafar_118 — Thu, 12 Sep 2013 13:48:58 GMT

Hi Jatin,

Thanks, that was the issue. When i first created the NDG, it did not pay attention to the field.

Cisco ACS Radius configuration

Jatin Katyal — Thu, 12 Sep 2013 20:35:59 GMT

Glad to know zafar.

~BR
Jatin Katyal

**Do rate helpful posts**