Can't authenticate with NPS Radius on CISCO CBS250-24T

[Sorin Vlasceanu]

Hello,

I recently started to use NPS Radius (included in Windows Server 2019) to authenticate on a series of Cisco Switches (SF200, SF220, SG200, SG220, SG250, CBS220-8T, CBS220-24T, CBS250-24T, CBS350-24T).

So far only SF220, SG220 and CBS220 are working fine.

The others are returning the error "Invalid user name or password. Please try again"

I am using the GUI interface.

Any ideas?

Thank you.

[marce1000]

           - Check the NPS radius server's   logs for the particular authenticating (and or failing attempts)

 M.

[Sorin Vlasceanu]

Hello,

I checked the logs. The most detailed reason for rejecting the connection was that "Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect".

The problem is that from all the switches I use (SF200, SF220, SG200, SG220, SG250, CBS220-8T, CBS220-24T and CBS350) the only ones that works are SF220, SG220 and CBS220. The others present the same problem. All are configured the same. I already tried firmware updates.

An earlier post here (about 2 years ago) was referring to the same issue with SG200. So the problem seams to be old but until now no fix.

Thank you.

[marce1000]

  >..."Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect".
        - Correct these parameters  ,

 M.

[Sorin Vlasceanu]

Hello,

The username or password is not an issue. I have tried several times and
the credentials are corect. As i said earlier it seems to be an error which
appears only on specific models.

[marce1000]

 - Can you verify if this syndrome is related to radius (or not) , by  for instance configuring the user local on the device with the same username and password ;                                                                                                       does that work ?

 M.

[Sorin Vlasceanu]

Hello,

You realize that it's not ok. If I configure the user localy with the same username and password the switch will use those credentials to authenticate me, not the one provided by the RADIUS.

Sorry to repeat myself but the RADIUS server is working fine because it's implemented on some switches and I can authenticate with the credentials it's providing.

The problem appears on specific models. (which I enumerated before).

[marce1000]

- It's only asked for a short test ,tx!

M.

[Sorin Vlasceanu]

With a local user (same username and password or different ones) its
working. That's how I logged in to configure Radius client on the switch.

[marce1000]

- Do any of the passwords have special characters ?

M.

[Sorin Vlasceanu]

No. Just small caps, large caps and numbers.

[Sorin Vlasceanu]

Ok. I will try.
The local user works with all 4 categories.

[marce1000]

   - What do you mean by '4 categories' ?

 M.

[Sorin Vlasceanu]

Small caps, large caps, numbers, special characters (!? _@#$)

[marce1000]

  - Try to make a  packet capure (using tcpdump , or other tool) ; to examine what is send to the radius server and check if that corresponds with the real credentials entered , (radius  is not encrypted)

 M.