topic Re: Radius server on Nexus switches issue in Network Access Control

Radius server on Nexus switches issue

timothy_MTS — Tue, 29 Oct 2024 04:05:14 GMT

Hello all,

Recently I am going to update our Microsoft infrastructure. It includes relocate the NPS RADIUS servers.

My two Nexus 9000 switches configured with the RADIUS servers. Then I found a problem that I couldn't remove the old RADIUS servers from the switch configuration.

radius-server host 10.0.0.2 key MYKEY authentication timeout 1
radius-server host 10.0.0.1 key MYKEY authentication timeout 1
radius-server host 10.0.0.100 key MYKEY authentication
aaa group server radius RADSRVS
   server 10.0.0.2
   server 10.0.0.1
   server 10.0.0.100
   deadtime 2
   use-vrf management
   source-interface mgmt0

I tried to remove the server under

aaa group server radius RADSRVS

   no server 10.0.0.2

It prompts the error "specified RADIUS server not found, please configure it using radius-server host ... and then retry"

However, I can add the radius-server host 10.0.0.100 into it. I can also remove 10.0.0.100 too. Just the two servers 10.0.0.2 and 10.0.0.1 cannot be removed.

-------

I have removed the two servers 10.0.0.2 and 10.0.0.1 from my other Nexus 9000 switch successfully. So I don't think this is the configuration or command errors. Just not sure what's holding at the back.

Any idea?

Regards,

Timothy

Re: Radius server on Nexus switches issue

M02@rt37 — Tue, 29 Oct 2024 07:06:08 GMT

Hello @timothy_MTS

Remove "aaa authentication login default group radius local" if configured then you will be able to remove the host...

Re: Radius server on Nexus switches issue

timothy_MTS — Tue, 29 Oct 2024 11:26:33 GMT

Hello M02@rt37

I checked there is a similar entry below.

aaa authentication login default group RADSRVS local 
aaa authentication login mschap enable

in this case, I should remove the first line, then I can remove the host?

If after removing the host, do I need to add this aaa authentication login back?

Thanks

Timothy

Re: Radius server on Nexus switches issue

M02@rt37 — Tue, 29 Oct 2024 12:19:11 GMT

@timothy_MTS

in this case, I should remove the first line, then I can remove the host? YES

If after removing the host, do I need to add this aaa authentication login back? YES