Radius AAA authentication issue on Cisco 3750E Switch

[iamloki]

After configuring all the radius setting on the switch and I get this error when I try to login with my username

Username:
Apr 14 06:47:56.597: AAA/BIND(00000026): Bind i/f
Apr 14 06:47:56.597: AAA/AUTHEN/LOGIN (00000026): Pick method list 'default'
Apr 14 06:47:56.597: RADIUS/ENCODE(00000026): ask "Username: "
Apr 14 06:47:56.597: RADIUS/ENCODE(00000026): send packet; GET_USER
Username: admin@greendc.local
Password:
Apr 14 06:48:12.677: RADIUS/ENCODE(00000026): ask "Password: "
Apr 14 06:48:12.677: RADIUS/ENCODE(00000026): send packet; GET_PASSWORD

Apr 14 06:48:27.835: RADIUS/ENCODE(00000026):Orig. component type = Exec
Apr 14 06:48:27.835: RADIUS/ENCODE(00000026): dropping service type, "radius-server attribute 6 on-for-login-auth" is off
Apr 14 06:48:27.835: RADIUS(00000026): Config NAS IP: 0.0.0.0
Apr 14 06:48:27.835: RADIUS(00000026): Config NAS IPv6: ::
Apr 14 06:48:27.835: RADIUS/ENCODE(00000026): acct_session_id: 28
Apr 14 06:48:27.835: RADIUS(00000026): sending
Apr 14 06:48:27.835: RADIUS/ENCODE: Best Local IP-Address <SWITCH/CLIENT IP> for Radius-Server <RADIUS SERVER IP>
Apr 14 06:48:27.843: RADIUS(00000026): Send Access-Request to <RADIUS SERVER IP>:1645 onvrf(0) id 1645/35, len 99
Apr 14 06:48:27.843: RADIUS: authenticator BD E5 63 55 DE B6 07 E7 - 51 3E 69 5D 38 16 58 0D
Apr 14 06:48:27.843: RADIUS: User-Name [1] 37 "admin@greendc.local"
Apr 14 06:48:27.843: RADIUS: User-Password [2] 18 *
Apr 14 06:48:27.843: RADIUS: NAS-Port [5] 6 0
Apr 14 06:48:27.843: RADIUS: NAS-Port-Id [87] 6 "tty0"
Apr 14 06:48:27.843: RADIUS: NAS-Port-Type [61] 6 Async [0]
Apr 14 06:48:27.843: RADIUS: NAS-IP-Address [4] 6 <SWITCH/CLIENT IP>
Apr 14 06:48:27.843: RADIUS(00000026): Sending a IPv4 Radius Packet
Apr 14 06:48:27.843: RADIUS(00000026): Started 5 sec timeout
Apr 14 06:48:27.852: RADIUS: Received from id 1645/35 <RADIUS SERVER IP>:1645, Access-Reject, len 20
Apr 14 06:48:27.860: RADIUS: authenticator 23 1C C6 48 C6 A8 DE FF - D3 13 38 44 95 1D 1B 60
Apr 14 06:48:27.860: RADIUS: response-authenticator decrypt fail, pak len 20

Anyone faced this issue?

[marce1000]

 - Looks like a bug , as an example note : https://bst.cloudapps.cisco.com/bugsearch?pf=prdNm&kw=response-authenticator%20decrypt%20fail&bt=custV&sb=anfr , none of those seem to match your platform however, but use latest advisory software version , check if that can help : https://software.cisco.com/download/home/282979365/type/280805680/release/15.2.4E10

 M.

[iamloki]

I'm using the same version:

ciscostack#show version
Cisco IOS Software, C3750E Software (C3750E-UNIVERSALK9-M), Version 15.2(4)E10, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2020 by Cisco Systems, Inc.
Compiled Tue 31-Mar-20 13:22 by prod_rel_team

[marce1000]

     - What's in the logs of the radius server , for that particular authentication ?

 M.

[iamloki]

From Server Manager > NPS tab I see 

A RADIUS message was received from the invalid RADIUS client IP address <Switch/Client IP>

Screenshot attached

Regards, 

Loki

[marce1000]

 - Check client configuration on the radius server, from the link below it seems that if it is not defined by ip that should be advisable , else it must be dns-resolvable for the radius server : https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd316135(v=ws.10)?redirectedfrom=MSDN

 M.

[Georg Pauwen]

Hello,

can you post the running configuration of your 3750 so we can see what you have configured ?

[iamloki]

Config Attached

[marce1000]

 - It seems that radius is apparently ISE-based, has the device been entered in ISE as NAD (network access device) with correct IP address ?

 M.

[iamloki]

Hi Marce, 

I dont remember doing this at all or even know about it. Would you suggest me to make some changes?

Regards, 
L

[Georg Pauwen]

Hello,

--> Apr 14 06:48:27.860: RADIUS: response-authenticator decrypt fail, pak len 20

This usually means that the passwords of the RADIUS server and the client do not match. Try and manually reenter the password on both:

server-private 10.0.64.33 non-standard key 7 104D000A0618 <-- cisco (decrypted), reenter that, do not copy and paste

[MHM Cisco World]

ip radius source-interface interface <- use this and check that this interface IP is add in AAA server.

If there is NAT between device and AAA server use 

radius-server attribute 4 ip-address

Or use both command.