Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
858
Views
0
Helpful
7
Replies

Unable to log into Device after configuring Radius

Jason Regan
Level 1
Level 1

‎04-25-2013 08:55 AM - edited ‎03-10-2019 08:21 PM

I hope someone can help me out here as I am totally stumped!!!

I've recently installed ISE and have gone through the setup and started adding devices with a standard AAA Radius Configuration.

The first one I've done works perectly but any subsequent device I try to add seems to be giving me problems in that when I try to log onto them using either the local-admin account I've configured or my domain account which has also been configured via an AD External ID Source it doesn't log into the device and comes back with

% Authorisation Failed

This is despite using the exact same commands that I used on my original device that is working fine!!

Here is teh config that is applied to both the devices

aaa new-model

Username local-admin privilege 15 password password

aaa group server radius ISE_Servers

server 10.200.1.19 auth-port 1645 acct-port 1646

server 10.200.2.19 auth-port 1645 acct-port 1646

aaa authentication login default group ISE_Servers local

aaa authentication enable default group ISE_Servers enable

aaa authorization exec default group ISE_Servers local if-authenticated

aaa accounting exec default start-stop group ISE_Servers

aaa accounting send stop-record authentication failure

aaa accounting commands 0 default start-stop group ISE_Servers

aaa accounting commands 1 default start-stop group ISE_Servers

aaa accounting commands 15 default start-stop group ISE_Servers

aaa accounting connection default start-stop group ISE_Servers

radius-server host 10.200.1.19 key Th4m3-Acc355

radius-server host 10.200.2.19 key Th4m3-Acc355

I've also run radius debugging which returned the following

083260: 24w1d: RADIUS: Pick NAS IP for u=0x26FC4D4 tableid=0 cfg_addr=0.0.0.0

083261: 24w1d: RADIUS: ustruct sharecount=1

083262: 24w1d: Radius: radius_port_info() success=1 radius_nas_port=1

083263: 24w1d: RADIUS(00000000): Send Access-Request to 10.200.1.19:1645 id 1645/12, len 80

083264: 24w1d: RADIUS:  authenticator 37 DE 3F 3F 39 2A 36 20 - FB 2E 43 1C 3D F3 C7 B7

083265: 24w1d: RADIUS:  NAS-IP-Address      [4]   6   192.168.10.248

083266: 24w1d: RADIUS:  NAS-Port            [5]   6   2

083267: 24w1d: RADIUS:  NAS-Port-Type       [61]  6   Virtual                   [5]

083268: 24w1d: RADIUS:  User-Name           [1]   11  "$$-jregan"

083269: 24w1d: RADIUS:  Calling-Station-Id  [31]  13  "10.200.1.19"

083270: 24w1d: RADIUS:  User-Password       [2]   18  *

083271: 24w1d: RADIUS: Received from id 1645/12 10.200.1.19:1645, Access-Accept, len 159

083272: 24w1d: RADIUS:  authenticator E6 CA 66 80 AA E2 39 0F - FE FE 7C 3D 50 A7 17 CC

083273: 24w1d: RADIUS:  User-Name           [1]   11  "$$-jregan"

083274: 24w1d: RADIUS:  State               [24]  40

083275: 24w1d: RADIUS:   52 65 61 75 74 68 53 65 73 73 69 6F 6E 3A 30 61  [ReauthSession:0a]

083276: 24w1d: RADIUS:   63 38 30 31 31 33 30 30 30 30 30 30 39 30 35 31  [c801130000009051]

083277: 24w1d: RADIUS:   37 39 34 32 45 33                                [7942E3]

083278: 24w1d: RADIUS:  Class               [25]  57

083279: 24w1d: RADIUS:   43 41 43 53 3A 30 61 63 38 30 31 31 33 30 30 30  [CACS:0ac80113000]

083280: 24w1d: RADIUS:   30 30 30 39 30 35 31 37 39 34 32 45 33 3A 54 4D  [00090517942E3:TM]

083281: 24w1d: RADIUS:   2D 56 4D 2D 49 53 45 30 31 2F 31 35 32 31 30 37  [-VM-ISE01/152107]

083282: 24w1d: RADIUS:   35 36 33 2F 36 37 39                             [563/679]

083283: 24w1d: RADIUS:  Termination-Action  [29]  6   1

083284: 24w1d: RADIUS:  Vendor, Cisco       [26]  25

083285: 24w1d: RADIUS:   Cisco AVpair       [1]   19  "shell:priv-lvl=15"

083286: 24w1d: RADIUS: saved authorization data for user 26FC4D4 at 2703008

083287: 24w1d: RADIUS: cisco AVPair "shell:priv-lvl=15"

083288: 24w1d: RADIUS: no appropriate authorization type for user.

008420: 19w4d: RADIUS(00000238): Config NAS IP: 0.0.0.0

008421: 19w4d: RADIUS/ENCODE(00000238): acct_session_id: 55

008422: 19w4d: RADIUS(00000238): sending

008423: 19w4d: RADIUS/ENCODE: Best Local IP-Address 192.168.10.7 for Radius-Server 10.200.1.19

008424: 19w4d: RADIUS(00000238): Send Access-Request to 10.200.1.19:1645 id 1645/79, len 127

008425: 19w4d: RADIUS:  authenticator C0 41 17 99 51 1E DE 63 - 7B BB 8F 26 23 A3 A0 C5

008426: 19w4d: RADIUS:  User-Name           [1]   11  "$$-jregan"

008427: 19w4d: RADIUS:  User-Password       [2]   18  *

008428: 19w4d: RADIUS:  NAS-Port            [5]   6   1

008429: 19w4d: RADIUS:  NAS-Port-Id         [87]  6   "tty1"

008430: 19w4d: RADIUS:  NAS-Port-Type       [61]  6   Virtual                   [5]

008431: 19w4d: RADIUS:  Calling-Station-Id  [31]  14  "192.168.2.51"

008432: 19w4d: RADIUS:  State               [24]  40

008433: 19w4d: RADIUS:   52 65 61 75 74 68 53 65 73 73 69 6F 6E 3A 30 61  [ReauthSession:0a]

008434: 19w4d: RADIUS:   63 38 30 31 31 33 30 30 30 30 30 30 38 43 35 31  [c801130000008C51]

008435: 19w4d: RADIUS:   37 39 33 46 32 33            [ 793F23]

008436: 19w4d: RADIUS:  NAS-IP-Address      [4]   6   192.168.10.7

008437: 19w4d: RADIUS: Received from id 1645/79 10.200.1.19:1645, Access-Accept, len 159

008438: 19w4d: RADIUS:  authenticator 7D 10 74 E1 96 86 9C FD - 4D C5 E7 5D 54 2B 18 A9

008439: 19w4d: RADIUS:  User-Name           [1]   11  "$$-jregan"

008440: 19w4d: RADIUS:  State               [24]  40

008441: 19w4d: RADIUS:   52 65 61 75 74 68 53 65 73 73 69 6F 6E 3A 30 61  [ReauthSession:0a]

008442: 19w4d: RADIUS:   63 38 30 31 31 33 30 30 30 30 30 30 38 43 35 31  [c801130000008C51]

008443: 19w4d: RADIUS:   37 39 33 46 32 33            [ 793F23]

008444: 19w4d: RADIUS:  Class               [25]  57

008445: 19w4d: RADIUS:   43 41 43 53 3A 30 61 63 38 30 31 31 33 30 30 30  [CACS:0ac80113000]

008446: 19w4d: RADIUS:   30 30 30 38 43 35 31 37 39 33 46 32 33 3A 54 4D  [0008C51793F23:TM]

008447: 19w4d: RADIUS:   2D 56 4D 2D 49 53 45 30 31 2F 31 35 32 31 30 37  [-VM-ISE01/152107]

008448: 19w4d: RADIUS:   35 36 33 2F 36 37 36           [ 563/676]

008449: 19w4d: RADIUS:  Termination-Action  [29]  6   1

008450: 19w4d: RADIUS:  Vendor, Cisco       [26]  25

008451: 19w4d: RADIUS:   Cisco AVpair       [1]   19  "shell:priv-lvl=15"

008452: 19w4d: RADIUS(00000238): Received from id 1645/79

TbS6966#

the debug output for the working device is as follows

008420: 19w4d: RADIUS(00000238): Config NAS IP: 0.0.0.0
008421: 19w4d: RADIUS/ENCODE(00000238): acct_session_id: 55
008422: 19w4d: RADIUS(00000238): sending
008423: 19w4d: RADIUS/ENCODE: Best Local IP-Address 192.168.10.7 for Radius-Server 10.200.1.19
008424: 19w4d: RADIUS(00000238): Send Access-Request to 10.200.1.19:1645 id 1645/79, len 127
008425: 19w4d: RADIUS:  authenticator C0 41 17 99 51 1E DE 63 - 7B BB 8F 26 23 A3 A0 C5
008426: 19w4d: RADIUS:  User-Name           [1]   11  "$$-jregan"
008427: 19w4d: RADIUS:  User-Password       [2]   18  *
008428: 19w4d: RADIUS:  NAS-Port            [5]   6   1
008429: 19w4d: RADIUS:  NAS-Port-Id         [87]  6   "tty1"
008430: 19w4d: RADIUS:  NAS-Port-Type       [61]  6   Virtual                   [5]
008431: 19w4d: RADIUS:  Calling-Station-Id  [31]  14  "192.168.2.51"
008432: 19w4d: RADIUS:  State               [24]  40
008433: 19w4d: RADIUS:   52 65 61 75 74 68 53 65 73 73 69 6F 6E 3A 30 61  [ReauthSession:0a]
008434: 19w4d: RADIUS:   63 38 30 31 31 33 30 30 30 30 30 30 38 43 35 31  [c801130000008C51]
008435: 19w4d: RADIUS:   37 39 33 46 32 33            [ 793F23]
008436: 19w4d: RADIUS:  NAS-IP-Address      [4]   6   192.168.10.7
008437: 19w4d: RADIUS: Received from id 1645/79 10.200.1.19:1645, Access-Accept, len 159
008438: 19w4d: RADIUS:  authenticator 7D 10 74 E1 96 86 9C FD - 4D C5 E7 5D 54 2B 18 A9
008439: 19w4d: RADIUS:  User-Name           [1]   11  "$$-jregan"
008440: 19w4d: RADIUS:  State               [24]  40
008441: 19w4d: RADIUS:   52 65 61 75 74 68 53 65 73 73 69 6F 6E 3A 30 61  [ReauthSession:0a]
008442: 19w4d: RADIUS:   63 38 30 31 31 33 30 30 30 30 30 30 38 43 35 31  [c801130000008C51]
008443: 19w4d: RADIUS:   37 39 33 46 32 33            [ 793F23]
008444: 19w4d: RADIUS:  Class               [25]  57
008445: 19w4d: RADIUS:   43 41 43 53 3A 30 61 63 38 30 31 31 33 30 30 30  [CACS:0ac80113000]
008446: 19w4d: RADIUS:   30 30 30 38 43 35 31 37 39 33 46 32 33 3A 54 4D  [0008C51793F23:TM]
008447: 19w4d: RADIUS:   2D 56 4D 2D 49 53 45 30 31 2F 31 35 32 31 30 37  [-VM-ISE01/152107]
008448: 19w4d: RADIUS:   35 36 33 2F 36 37 36           [ 563/676]
008449: 19w4d: RADIUS:  Termination-Action  [29]  6   1
008450: 19w4d: RADIUS:  Vendor, Cisco       [26]  25
008451: 19w4d: RADIUS:   Cisco AVpair       [1]   19  "shell:priv-lvl=15"
008452: 19w4d: RADIUS(00000238): Received from id 1645/79

If anyone has experienced this before or know of a document that can assist I would be eternally grateful

Thanks

Labels:
0 Helpful
7 Replies 7

edwjames
Level 3
Level 3

‎04-26-2013 03:34 PM

Jason,

Try this:

radius-server authorization permit missing Service-Type

Do rate if useful

**Share your knowledge. It’s a way to achieve immortality. --Dalai Lama** Please Rate if helpful. Regards Ed
0 Helpful

Jason Regan
Level 1
Level 1
In response to edwjames

‎05-01-2013 01:02 AM

Hi Edward,

Unfortunately this has not resolved the issue.

I think it has something to do with the NAS-Port configuration as this seems to be where the differences are in all the logs I have looked at.

Thanks anyway

Jason

0 Helpful

Jagdeep Gambhir
Level 10
Level 10
In response to Jason Regan

‎05-01-2013 03:11 AM

Jason,

Seems like device or IOS specific issue. Can you tell be code on working & non-working device?

Regards,

~JG

Do rate helpful posts

0 Helpful

Jason Regan
Level 1
Level 1
In response to Jagdeep Gambhir

‎05-01-2013 03:37 AM

Hi Jaqdeep,

Working config device and IOS is

C2960-24PC-L, C2960-LANBASE-M 12.2<44> SE2

non working device is

C3560-24PS, C3560-IPBASE-M 12.2(325)SE5

Any advice you could give would be greatly received

Regards

Jason


0 Helpful

Jagdeep Gambhir
Level 10
Level 10
In response to Jason Regan

‎05-01-2013 03:54 AM

Can you set service type = administrative and that should work.

Regards,

~JG

0 Helpful

Jason Regan
Level 1
Level 1
In response to Jagdeep Gambhir

‎05-01-2013 04:40 AM

Where am I setting this?

Regards

Jason

0 Helpful

Jagdeep Gambhir
Level 10
Level 10
In response to Jason Regan

‎05-01-2013 11:47 AM

Jason,

You need to set it on Authorization profile that is used (Under advanced attribute settings) to process that request.

RADIUS:Service-Type = Administrative

Regards,

~JG

Do rate helpful posts

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents