Aruba Switch ssh Authentication via Cisco ISE 2.4 Radius

[Capricorn]

Hello!

I have created the policy for my Aruba switch ssh login via Cisco ISE. I have played around but cannot get it working.

Right now I have modified it to simipliest but still it doesnt work.

So I have the following configuration.

Policy Set name: Access-for-Switches

Condition: If device-location EQUALS OFFICE-BUILDING

      AND

               Device Type EQUALS ARUBA-SWITCHES

Default Network Access

Authentication Policy

 Default

      USE: My-company-sequence (containing my AD)

AUTHORIZATION Policy:

condition:

IF AD:EXTERNALgroups EQUALS IT-Admin

Results:

Aruba: Aruba-Priv-Admin-Role = root

Attributes Details

Access Type = ACCESS_ACCEPT
Aruba-Admin-Role = root

Error:

Event 5400 Authentication failed
Failure Reason 15039 Rejected per authorization profile

I have also with different option but no success.

Please suggest in this case.

Thanks

[Damien Miller · Accepted solution]

You may have to use "contains" or "end with" as the logic operand in device location and device type conditions because they are sub groups to the parents. I'm just assuming right now that they aren't an exact match because a device typically sits under all device types or all locations.

[Capricorn]

Thanks.

Not sure how its set to SOLVED.

Anyways to me the issue look like in the condition.

condition:

IF AD:EXTERNALgroups EQUALS IT-Admin

Results:

Aruba: Aruba-Priv-Admin-Role = root

Attributes Details

Access Type = ACCESS_ACCEPT
Aruba-Admin-Role = root

I can understand its more towards Aruba about the privilege access level radius value but so far I am not able to find anything.

[Jason Kunst]

i would check with aruba to see what they need

[Capricorn]

Thanks. Did you get reply from them?

[Capricorn · Accepted solution]

The following settings worked for me.

Network Device Profile = Cisco
Access Type = ACCESS_ACCEPT
Service-Type = 6

[Romanpreet Singh]

I have the same issue. Did we ever find what attributes to use for Aruba radius authentication?

Service-Type=6 doesn't work with Aruba.

[Capricorn]

This worked for me on Aruba 2540, 2930.

Network Device Profile = Cisco
Access Type = ACCESS_ACCEPT
Service-Type = 6

Which model do you have and what condition you are using so I can compare it with my settings.