Windows 2008 NPS Radius and AAA

[adamm2008]

I am trying to get Windows NPS Radius to authenticate users into switches and routers. I have followed a very thorough document that I found online. However, I am not having success getting authentication to work. Has anyone had any success with integrating this before?

[Collin Clark]

I have and I made a recording of it. You can find it here-

https://packetpros.com/cisco_kb/RADIUS_2008.html

Hope it helps.

[greg.washburn]

The video example sets up the windows side ok but there is nothing about the cisco side.

Something like:

aaa new-model

aaa group server radius authservlist

server 10.1.1.1

aaa authentication login authlist local group authservlist

radius-server host 10.1.1.1 key someverylongpassword

line con 0

login authentication authlist

line vty 0 4

login authentication authlist

I think that's all you would need for the cisco side

[Jagdeep Gambhir]

Bingoo!

Thanks for sharing it Collin

[adamm2008]

HUGE help, thank you very much. I have it working now.

[Collin Clark]

It's was a real pain to set up, took me about 1/2 a day to figure it out. Glad it helped.

[adamm2008]

I may have spoken a little too soon. I had no problems with 3560, 3750 series devices. I am currntly having problems with 2950 and 2960 devices. When I do a 'debug radius' I get errors:

RADIUS: Cisco AVPair "shell:priv-lvl=15"

RADIUS: unrecognized Vendor code 311

RADIUS: unrecognized Vendor code 311

RADIUS: no appropriate authorization type for user.exit

[Collin Clark]

Can you post your AAA config from a 2950 or 2960?

[adamm2008]

Posting 2960 config with debug information at bottom.

[adamm2008]

HUGE help, thank you very much. I have it working now.

[spidermanchar]

Hello there,

The link is not available anymore, could I find it anywhere?

Thanks,

Victor

[MehulMehta9701]

Hi Colin,

I see the link is broken.

https://packetpros.com/cisco_kb/RADIUS_2008.html

Can you please provide me link again?

Thank you,

Mehul

[Duke_RLA]

Hi.

I have exactly the same problem with 2950 and radius authentication

RADIUS:  unrecognized Vendor code 311

RADIUS:  unrecognized Vendor code 311

RADIUS:  no appropriate authorization type for user.exit

Can anyone help with this problem?

[minkumar]

Hey

can you check if you have done the following config

1.push the service type = login

2.Set the Attribute Format to "String"

Type "shell:priv-lvl=15" in the Attribute Value field

Let me know if it helped.

[Duke_RLA]

Thanks for the help!

shell:priv-lvl=15 was already there but it only grants privelege mode.

Service-Type = Login  setting worked like a charm.