3725 RAS server ios12.2 asa radius to ACS5.1 question

[demory1210]

I have a 3725 that was using tacacs for auth but that is not working with our new ACS 5.1 server so for simplicity I would like to switch to radius. The authentications pass but the dial in user gets error 738 "didn't assign an address"

My auth on the 3725 is

radius-server configure-nas

radius-server host 172.30.2.172 auth-port 1645 acct-port 1646

radius-server key ********

radius-server authorization permit missing Service-Type

aaa authentication ppp default group radius local-case

aaa authorization network default group radius

aaa accounting exec default start-stop group radius

aaa accounting network default start-stop group radius

Ant ideas would be appreciated! thanks

[Nicolas Darchis]

Hi,

I think the problem is in the attributes you are sending back from ACS, not with the 3725 config.

Are your clients relying on radius assigned ip addresses ? Can you collect a debug radius to see what you are returning ?

Nicolas

[demory1210]

General OS:

  AAA Authentication debugging is on

  AAA Authorization debugging is on

  AAA Accounting debugging is on

PPP:

  PPP detailed event debugging is on

  PPP authentication debugging is on

  PPP protocol errors debugging is on

Radius protocol debugging is on

Radius protocol verbose debugging is on

Radius packet protocol debugging is on

I have turned on all the following debugging and nothing is printed to the console while dialing in. Is there a way that debugging is not sent to the console? Also how do I associate an ip pool with my device in ACS 5,1. The new acs software is rather confusing, I guess that's a given since it's a cisco product.

thanks!

[demory1210]

interface Group-Async1

ip unnumbered FastEthernet0/0

encapsulation ppp

ip tcp header-compression

no ip mroute-cache

async mode interactive

peer default ip address pool 172.30.3.0-172.30.3.150

no keepalive

no fair-queue

ppp authentication pap

group-range 65 88

!

peer default ip address pool RAS

I changed the above line to be a defined pool to no avail. Don't know if this adds any new info

thanks

[demory1210]

peer default ip address pool 172.30.3.0-172.30.3.150

I changed this to

peer default ip address pool dhcp

and it works.

thanks