topic Radius Automated Test in Network Access Control

Radius Automated Test

lionel.dupont — Tue, 26 Mar 2019 00:30:34 GMT

Hello,

I have performed the following configuration on one of my switch to test periodically the availability of ISE servers :

radius server ISE-1

address ipv4 1.2.3.4 auth-port 1645 acct-port 1646

key 0 toto123

automate-tester username radius-test idle-time 10

username radius-test password toto

And on the ISE server I can see authentication failed with code

Authentication failed :

22040 Wrong password or invalid shared secret

I am sure about the shared secret because when I try test aaa group ....from the same switch it is ok.

Does the automated test expect a valid access accept response ?

Thanks

Radius Automated Test

Ravi Singh — Tue, 25 Jun 2013 15:47:53 GMT

Yes it is expect a valid access accept response. That is the reason due to which you are getting error.

Radius Automated Test

Octavian Szolga — Tue, 25 Jun 2013 19:18:37 GMT

It's an IOS platform specific behavior. I observed the same behaviour on different switches.

See the following thread https://supportforums.cisco.com/thread/2170907

The NAD does not expect accept accept response to consider ISE alive. Any type of answer means that ISE is alive.

Radius Automated Test

bbosch4210 — Wed, 26 Jun 2013 10:36:12 GMT

I tested this on 15.0(2)SE2 and got it working with the following:

'service password-encryption' is configured

I use the password option in the radius-test username (Not secret)

The password I configure on the ISE is the encrypted password (Same as what you would see in a 'show run')

I hope this helps in some way. I haven't tested with the 'secret' option.

The question I really have is whether I really need to configure the "RADIUS automated tester" feature at all.

And whether I need to load balance to my ISE PSNs. My logs are full of radius-test user entires.

I have searched for guidence on this without any success.

Radius Automated Test

Jatin Katyal — Wed, 26 Jun 2013 16:59:54 GMT

Use the automate-tester command to enable automatic testing on the RADIUS server accounting and authentication UDP ports for RADIUS server load balancing. The username could be any username.

http://www.cisco.com/en/US/docs/ios-xml/ios/security/a1/sec-cr-a3.html#wp6780179500

I agree with Octavian that NAD doesn't necessarily expect radius-accept to consider ISE active.

Jatin

*Do rate helpful posts*