topic Re: AS5300 login problems with AAA in Network Access Control

AS5300 login problems with AAA

vvvmell — Fri, 21 Feb 2020 17:58:12 GMT

I have gotten my dialup to work, however I am confused on my AAA configuration. I am using the following:

aaa authentication login SECURE group radius local

aaa authentication login NO_AUTHEN none

aaa authentication login LOCAL line

aaa authentication ppp default if-needed group radius local

aaa authentication ppp SECURE if-needed group radius local

aaa authorization network default group radius local

aaa authorization network SECURE group radius local

The SECURE is what is applied to my lines.

Radius passes off to a Cisco Secure ACS database, and hands off to SDI token card server.

The problem is when I dial in and passthrough the authentication to radius it leaves me at the router prompt. At which poing I need to enter PPP and close my dialup terminal to be authenticated to the network. I'd like to avoid that final process and after passing authentication have the terminal initiate the ppp automatically.

I have tried changes like removing the login, it's my understanding that if access to the EXEC prompt isn't neccesary the login option isn't needed. When removed however, all authentication fails.

What advice do you have?

Re: AS5300 login problems with AAA

vvvmell — Fri, 16 Nov 2001 06:17:09 GMT

Try using the autocommand on the lines.

line 1 96

autocommand ppp

Thanks anyways.

Re: AS5300 login problems with AAA

trenth — Thu, 14 Feb 2002 21:01:17 GMT

What configuration have you setup on your Group-Async interface. Have you included "async mode interactive" and also what is set up on the line configuration for ppp auth? I have include the a sample of what your configuration may include.

aaa new-model

aaa authentication login default group radius local

aaa authentication ppp default group radius local

aaa authorization exec default group radius local

aaa authorization network default group radius local

aaa accounting exec default start-stop group radius

aaa accounting network default start-stop group radius

interface Virtual-Template1

ip unnumbered Loopback0

no ip route-cache

keepalive 20

timeout absolute 35790 0

ppp authentication chap

ppp multilink

ppp timeout idle 0

interface Group-Async1

ip unnumbered Loopback0

encapsulation ppp

no ip mroute-cache

timeout absolute 35790 0

dialer in-band

dialer idle-timeout 0

async dynamic address

async mode interactive

no peer default ip address

no fair-queue

no cdp enable

ppp authentication chap

ppp multilink

group-range 1 120

line 1 120

session-timeout 35791

exec-timeout 0 0

modem InOut

transport input all

autoselect during-login

autoselect ppp

Re: AS5300 login problems with AAA

tepatel — Fri, 15 Feb 2002 00:59:58 GMT

"autocommand ppp nego" OR "autocommand ppp" will prevent the router to display the router prompt. That will make the router start the ppp right-a-way after successful authentication..Tejal

Re: AS5300 login problems with AAA

michelle.andersen — Fri, 15 Feb 2002 13:26:17 GMT

Is there a way to make the post terminal window go away automatically after ppp is negotiated successfully?

Re: AS5300 login problems with AAA

tepatel — Sat, 16 Feb 2002 06:27:13 GMT

Nope..There is no automatic way to make the terminal window go away. With terminal window, control is given back to user..And user has to "click" to move forward. Now you can write some special "software script" which can automate that...Thx..Tejal