ISE RADIUS and Nexus 9k

[emrglr]

I have Nexus 9k connected to an ISE server for login authentication and the login goes through and I am successfully logged into the 9k however when i try to log in same username/wrong password login goes successfully anyway. So i think ISE not checking the password. What am I missing?

--------------------------------------------

radius-server key 7 "fewhg"
radius-server host 172.16.5.238 authentication accounting
aaa group server radius ISE
server 172.16.5.238
source-interface Vlan5

aaa authentication login default group ISE ISE

--------------------------------------------

[MHM Cisco World]

that so wired, 
please share below 
show radius-server hostname statistics 

[emrglr]

There is no such command. is this the command you want?

SW-C9300-01# show radius-server sorted
Global Radius shared secret:********
timeout value:5
retransmission count:1
deadtime value:0
secure radius mode:none
source interface:any available
total number of servers:1

following RADIUS servers are configured:
172.16.5.238:
available for authentication on port: 1812
available for accounting on port: 1813
timeout:5
retries:1
tls idle timeout:600

[MHM Cisco World]

show radius-server  statistics <server name>

[emrglr]

SW-C9300-01# show radius-server statistics 172.16.5.238
Server is not monitored

Authentication Statistics
failed transactions: 16
sucessfull transactions: 31
requests sent: 59
requests timed out: 24
responses with no matching requests: 0
responses not processed: 4
responses containing errors: 0

Accounting Statistics
failed transactions: 0
sucessfull transactions: 0
requests sent: 0
requests timed out: 0
responses with no matching requests: 0
responses not processed: 0
responses containing errors: 0

[Nancy Saini · Accepted solution]

I am suspecting misconfiguration in authentication policy on ISE. Could you check if option selected in "If Auth fails" is "Continue". It should be "Reject".

[emrglr]

Thank you vey much Nancy. It worked.