AAA Radius server Failure- ISE

[Srinivasan Nagarajan]

Hi Experts,

We've an ISE as an authentication server for the Remote access VPN users with ASA as the Authenticator with RSA as MFA. Noticed out of 2 PSN, ASA has marked the primary one as failed and authenticating via the secondary PSN node.

We've not specified the reactivation mode and I believe it's depletion by default. Basic health checks of the ISE node looks good.

Not sure what to check. Can someone please assist.

Thanks in advance

[Mike.Cifelli · Accepted solution]

Assuming when you check, you run a # show aaa-server and the one shows as Active & the other does not?

Some routine checks: 

-Can you ping the failed psn?

-Are the PSNs located in the same subnet/location?

-Are there possibly ACLs somewhere in the path blocking the ASA?

-Have you attempted to run any debugs from the ASA to gather more log/failure reasons?

HTH!

[Srinivasan Nagarajan]

Hi @Mike.Cifelli 

Yes, Both are in the same subnet and I'm able to ping the ISE

There is no ACL in the path and it's showing as 'FAILED' when I give 'show aaa-server protocol radius'

[Mike.Cifelli]

Are both PSNs in the same AAA group & referenced in same AAA list?  Are both PSNs properly setup with right persona in ISE? Have you attempted to run any tcpdumps on ISE side to further tshoot?

-Maybe try running debugs on ASA side.

-Also, you can test authentication via: 

test aaa-server authentication GROUP_NAME username johndoe password cisco123 

[Srinivasan Nagarajan]

Hi @Mike.Cifelli 

I've not run tcpdumps on ISE node. We manage client network and we dont have the username/password for the test aaa-server command to run.

 If we run this command, I believe this will bring the PSN node up. Will there be any impact for the end-users during the time-frame if ASA is forwarding the Radius Authentication requests to ISE  (if the ISE isn't responding or failing to the Radius Authentication for some reason)?

We've not specified the Reactivation mode and I believe it's depletion mode by default. Is it correct?

[Mike.Cifelli]

 If we run this command, I believe this will bring the PSN node up. Will there be any impact for the end-users during the time-frame if ASA is forwarding the Radius Authentication requests to ISE  (if the ISE isn't responding or failing to the Radius Authentication for some reason)?

-No you will be fine when running the test AAA command.

We've not specified the Reactivation mode and I believe it's depletion mode by default. Is it correct?

-AFAIK, yes this is correct.  I believe the default settings are:

Depletion
Dead time: 10 min
max fails: 3

You do have the ability to switch it to Timed mode which will attempt to reactive failed AAA servers after X amount of time.  

HTH!

[Srinivasan Nagarajan]

Thanks @Mike.Cifelli 

Here we've username+passcode for RA VPN (Identity source is RSA and not AD), so if I enter the username/password using test aaa-server command, it's showing AAA failure.

Can you please let me know is there any other way to bring the ISE node up for authentication?

And please let me know which one is preferred? Is it timed or depletion mode?

[Mike.Cifelli]

• Timed mode—The failed or deactivated servers are reactivated after 30 seconds of downtime.
• Depletion mode—The failed or deactivated servers remain inactive until all other servers within the configured group are inactive.

Can you please let me know is there any other way to bring the ISE node up for authentication?

I would suggest testing with timed mode.  Have you tried completely removing the failed AAA node, and then re-adding it back to config?

[Srinivasan Nagarajan]

Thanks Mike.

1. When using timed mode, if the server is down, then ASA will try to authenticate with it every 30seconds, affecting the users authentication requests?

2.Can you please suggest how to utilize the test aaa-server command when RSA is used as the Identity source?

[Mike.Cifelli]

1. When using timed mode, if the server is down, then ASA will try to authenticate with it every 30seconds, affecting the users authentication requests?

-This will not affect users auth request as you have two AAA servers configured.

2.Can you please suggest how to utilize the test aaa-server command when RSA is used as the Identity source?

-This is a good question that I am not 100% sure of.  The test AAA command will aide in verifying if your radius server/shared secret are correct.  This "test" command typically uses username/password to verify against the remote AAA source.  I suppose as a workaround you could quickly setup a local identity (user/pass) within ISE to then simply use with your test command just to see if that will bring the PSN back alive.  Keep in mind you will need some sort of basic policy that will allow your test to hit/match.

Lastly, IMO you have several options here to test.  If none of them suffice I would suggest getting with TAC.  HTH!

[Srinivasan Nagarajan]

Thanks Mike.

I manually bring the server by the below command and it start authenticating as expected.

ciscoasa# aaa-server active host X.X.X.X

Final one, Would like to understand why it was marked as 'Failed' though we've reachability? Any thoughts?

[Mike.Cifelli]

Perhaps loss of connectivity at one point, honestly without digging deeper into logs everything would just be assumption based.  I would suggest looking at internal logs.  Glad you were able to manually active it again.  As a reminder, with depletion mode the failed or deactivated servers remain inactive until all other servers within the configured group are inactive.  In your case I would keep an eye on them or consider switching the config to timed mode.