ASA 5525 - Radius server REJECT

1uplink — Sat, 25 Apr 2020 21:06:06 GMT

Hey everyone,

I am in the middle of an issue from a simple scenario.

FW1 -----FW2-----Radius server

I set up FW1 to authenticate to the radius server, (FW2 is allowing traffic to/from radius server)

aaa-server radserver protocol radius
aaa-server radserver (management) host 192.168.1.1
key secretkey
authentication port 1645
aaa authentication ssh console radserver LOCAL
aaa authentication enable console radserver LOCAL

FW1 is added to the server with the correct IP radius traffic is flowing between them without a problem

However I get message REJECT

Its a pretty simple scenario and its not working.

FW1 is connected to FW2 through a mgmt sw in the management interface, there is connectivity, radius traffic is flowing.

Server side looks fine, I dont have access to the server, but verified some points with the server admin, and I cant figure out where the issue is

Any suggestions???????

DEBUG OUTPUT:

INFO: Attempting Authentication test to IP address (192.168.1.1) (timeout: 10 seconds)

radius mkreq: 0x80000004

alloc_rip 0x00002aaac9b1b6c0

new request 0x80000004 --> 217 (0x00002aaac9b1b6c0)

got user 'myuser'

add_req 0x00002aaac9b1b6c0 session 0x80000004 id 217

RADIUS_REQUEST

radius.c: rad_mkpkt

RADIUS packet decode (authentication request)

--------------------------------------

Raw packet data (length = 88).....

01 d9 00 58 f2 19 c7 73 93 19 2f b6 17 00 03 e1 | ...X...s../.....

39 8f bd 6e 01 0b 6a 67 6f 6e 7a 61 6c 65 7a 02 | 9..n..testuser.

12 e6 a1 f5 1f af c3 0b 73 a1 66 df 3f 4a 50 8c | ........s.f.?JP.

0c 04 06 0a 7d fe 22 05 06 00 00 02 b9 3d 06 00 | ....}."......=..

00 00 05 1a 15 00 00 00 09 01 0f 63 6f 61 2d 70 | ...........coa-p

75 73 68 3d 74 72 75 65 | ush=true

Parsed packet data.....

Radius: Code = 1 (0x01)

Radius: Identifier = 217 (0xD9)

Radius: Length = 88 (0x0058)

Radius: Vector: F219C77393192FB6170003E1398FBD6E

Radius: Type = 1 (0x01) User-Name

Radius: Length = 11 (0x0B)

Radius: Value (String) =

6a 67 6f 6e 7a 61 6c 65 7a | myuser

Radius: Type = 2 (0x02) User-Password

Radius: Length = 18 (0x12)

Radius: Value (String) =

e6 a1 f5 1f af c3 0b 73 a1 66 df 3f 4a 50 8c 0c | .......s.f.?JP..

Radius: Type = 4 (0x04) NAS-IP-Address

Radius: Length = 6 (0x06)

Radius: Value (IP Address) = 192.168.2.30

Radius: Type = 5 (0x05) NAS-Port

Radius: Length = 6 (0x06)

Radius: Value (Hex) = 0x2B9

Radius: Type = 61 (0x3D) NAS-Port-Type

Radius: Length = 6 (0x06)

Radius: Value (Hex) = 0x5

Radius: Type = 26 (0x1A) Vendor-Specific

Radius: Length = 21 (0x15)

Radius: Vendor ID = 9 (0x00000009)

Radius: Type = 1 (0x01) Cisco-AV-pair

Radius: Length = 15 (0x0F)

Radius: Value (String) =

63 6f 61 2d 70 75 73 68 3d 74 72 75 65 | coa-push=true

send pkt 192.168.1.1/1645

rip 0x00002aaac9b1b6c0 state 7 id 217

rad_vrfy() : response message verified

rip 0x00002aaac9b1b6c0

: chall_state ''

: state 0x7

: reqauth:

f2 19 c7 73 93 19 2f b6 17 00 03 e1 39 8f bd 6e

: info 0x00002aaac9b1b800

session_id 0x80000004

request_id 0xd9

user 'myuser'

response '***'

app 0

reason 0

skey 'secretkey'

sip 192.168.1.1

type 1

RADIUS packet decode (response)

--------------------------------------

Raw packet data (length = 20).....

03 d9 00 14 14 06 dc ee e7 0a 65 e2 1f fb b1 4b | ..........e....K

78 ce b9 23 | x..#

Parsed packet data.....

Radius: Code = 3 (0x03)

Radius: Identifier = 217 (0xD9)

Radius: Length = 20 (0x0014)

Radius: Vector: 1406DCEEE70A65E21FFBB14B78CEB923

rad_procpkt: REJECT

RADIUS_DELETE

remove_req 0x00002aaac9b1b6c0 session 0x80000004 id 217

free_rip 0x00002aaac9b1b6c0

radius: send queue empty

ERROR: Authentication Rejected: AAA failure

topic ASA 5525 - Radius server REJECT in Network Security

ASA 5525 - Radius server REJECT