topic Re: ISE 2.4 and Radius on Ciena Optical Platforms in Network Access Control

ISE 2.4 and Radius on Ciena Optical Platforms

cmlozano8 — Thu, 27 Sep 2018 18:48:08 GMT

Hi All,

I am having difficulty getting radius authentication to work with our Ciena 6500 optical chassis. Trying to do Radius with PAP. I have policy sets defined with TACACs and Radius. Tacacs works fine. I have a single policy that is suppossed to match network access protocol radius and from their authorize based on user and group, however I can't seem to get any hits on the policy. The radius live logs indicate it is hitting default which doesn't permit PAP. However the hit counters don't increment for the default catch all rule either at the bottom so I am not sure what I am hitting. If I can get the requests to hit the policy I created I think I should be good. The only condition for the policy is Network Access Protocol Radius. Is there something else I need to do to make this work? Or is there something else I may need to consider given they are not Cisco devices?

We currently have the Ciena devices successfully doing Radius Auth via Windows Network Policy Server without issue.

Re: ISE 2.4 and Radius on Ciena Optical Platforms

Timothy Abbott — Thu, 27 Sep 2018 18:53:34 GMT

Just so I understand correctly, you have a policy set for these optical switches and are trying to match that policy using RADIUS? If that is correct, why not try to match based on device type instead? You can add all those switches to a device type and then us it to match RADIUS requests.

Regards,
Tim

Re: ISE 2.4 and Radius on Ciena Optical Platforms

cmlozano8 — Thu, 27 Sep 2018 19:02:24 GMT

Hi Tim,
Thanks for the suggestion, I did try that as I have created a seperate group for the Optical Chassis however I am getting the same exact behavior. I don't see any hits going up. Even moved the rule to the very top. Almost as if it is not even trying the policy set.

Re: ISE 2.4 and Radius on Ciena Optical Platforms

Timothy Abbott — Thu, 27 Sep 2018 19:06:34 GMT

You may be running into an issue I’ve seen in the past. Are you using “equals” in your condition to match the policy set? If so, trying using “starts with” instead. If that doesn’t work, I recommend contacting the TAC to troubleshoot further.

Regards,
Tim

Re: ISE 2.4 and Radius on Ciena Optical Platforms

Peter Koltl — Sun, 30 Sep 2018 10:35:03 GMT

You need to have an authentication rule covering PAP in the Allowed Protocols list.

Re: ISE 2.4 and Radius on Ciena Optical Platforms

Aravind Ravichandran — Sun, 30 Sep 2018 17:23:11 GMT

Please attach the policy screenshot and the detailed radius log.

Re: ISE 2.4 and Radius on Ciena Optical Platforms

thomas — Sun, 30 Sep 2018 19:27:31 GMT

IF the default authentication policy does not include PAP, then you will either need to add it to the default or create a new authentication rule that does.

Note that authentication & authorization policy hits are not updated real-time. ISE updates the hit counters every 10 minutes or so. Use Livelog error messages to understand what rules are being hit and why.

Re: ISE 2.4 and Radius on Ciena Optical Platforms

cmlozano8 — Mon, 01 Oct 2018 12:55:32 GMT

Attached policy screenshot. Note that the last two rules have shown 0 and 5 hits for weeks, so neither rule is getting hit. Also, the default device admin allowed protocols profile has pap radius allowed. Also below is the detailed auth report.

Overview

Event	5400 Authentication failed
Username	scrubbed
Endpoint Id
Endpoint Profile
Authentication Policy	Default
Authorization Policy	Default
Authorization Result

Authentication Details

Source Timestamp	2018-10-01 07:53:09.539
Received Timestamp	2018-10-01 07:53:09.539
Policy Server	scrubbed
Event	5400 Authentication failed
Failure Reason	15024 PAP is not allowed
Resolution	Enable PAP/ASCII protocol for the selected service
Root cause	PAP is not allowed
Username	scrubbed
Network Device	ION015OT03P
Device Type	All Device Types#DC Core#Optical
Location	All Locations
NAS IPv4 Address	scrubbed
Response Time	3 milliseconds

Other Attributes

ConfigVersionId	284
Device Port	5556
DestinationPort	1812
RadiusPacketType	AccessRequest
Protocol	Radius
NetworkDeviceProfileId	b0699505-3150-4215-a80e-6753d45bf56c
IsThirdPartyDeviceFlow	false
AcsSessionID	inv001ise01p/323033956/7111027
CPMSessionID	0a800a28LmSHodSQfzi0b6n5i6Sop3TJkKLH9RgDBnXqTuLbiqs
ISEPolicySetName	Default
DTLSSupport	Unknown
Network Device Profile	Cisco
Location	Location#All Locations
Device Type	Device Type#All Device Types#DC Core#Optical
IPSEC	IPSEC#Is IPSEC Device#No
RADIUS Username	scrubbed
NAS-Identifier	scrubbed
Device IP Address	scrubbed
Called-Station-ID	scrubbed

Result

RadiusPacketType	AccessReject
AuthenticationResult	NotAllowed

Steps

	11001	Received RADIUS Access-Request
	11017	RADIUS created a new session
	11117	Generated a new session ID
	15049	Evaluating Policy Group
	15008	Evaluating Service Selection Policy
	15048	Queried PIP - Network Access.Protocol
	15048	Queried PIP - DEVICE.Device Type
	15024	PAP is not allowed
	11003	Returned RADIUS Access-Reject

Re: ISE 2.4 and Radius on Ciena Optical Platforms

cmlozano8 — Mon, 01 Oct 2018 13:00:40 GMT

attached allowed protocols "default device admin"

Re: ISE 2.4 and Radius on Ciena Optical Platforms

Aravind Ravichandran — Mon, 01 Oct 2018 14:03:30 GMT

Hi,

You have configured Radius related policies under device admin policy sets,try to create the same policy under Policy->Policy sets & use Default network access in Allowed protocol.

Re: ISE 2.4 and Radius on Ciena Optical Platforms

cmlozano8 — Mon, 01 Oct 2018 15:57:28 GMT

Yes! Thanks that was my problem. Didn't realize they were separate. I am now hitting the policy. Now I need to tshoot authorization as I am not getting full admin rights in the Ciena GUI.