SG300-28 RADIUS login

[Martin Oesting]

Hi,

I have some 2960s and they work like a charm. I configured RADIUS access on them and had no problems with that.

Now I have two C300 (SG300-28) and I can't get them to work with my RADIUS server, I always get an "authentication failed".

Here are the commands on one of the boxes:

encrypted radius-server key <encrypted key>

radius-server host <radius host IP> auth-port 1645 acct-port 1646

aaa authentication enable SSH radius enable

aaa authentication login SSH radius local

Also, why is it presenting me the login twice when I connect via ssh (first with "login-as:" and no password and then with "User Name:" and with a password?!) ? At the first login I can type whatever I want and only the second login is the real one.

Greetings

Martin

[Steven Carnahan]

Thank you, that worked like a charm. Now only get the Login as prompt and not the additional Username prompt.

Now I just need to get the Radius working properly.  :)

[Michal Bruncko · Accepted solution]

Still not working even after two years? :)
- do you have similar configuration like mentioned here: http://www.tech-recipes.com/rx/1478/how-to-setup-ias-to-use-radius-to-authenticate-cisco-device/ ?
- did you tried to increase IAS logging verbosity?
- did you performed packet capture to see RADIUS conversation between both parties? If so, did you saw Access-Accept or Access-Reject response coming from RADIUS server?
- if it is "Access-Reject", are you sure you are using correct login name password? did you see correct values (username and password) inside RADIUS conversation (inside message Access-Request)? If so, are you use complicated password with non ASCII characters? Have you tried to simplify it to include only ASCII characters in password (I hope this is requirement)?
- if it is "Access-Accept" message coming from RADIUS and you still not having access to device, have you checked mandatory fields inside "Access-Accept" message? both following were required in my scenario:

Service-Type = Administrative-User,
Cisco-AVPair = "shell:priv-lvl=15"

For me it is working well, but I am using FreeRADIUS instead of IAS (but this should not matter at all).

[Michael Donaldson]

Thanks Michael Bruncko. Changing the service-type from "Login" to "Administrative" on my NPS Win 2012 R2 server fixed it.

Would never have gotten there without your post.

Cheers!

[00u17ijrcn4iTTKHb5d7]

SG300 Switches doesn’t allow AAA authentication. Request your support.

Following are the commands used for the config.

·         Radius-server host <IP> key <key>

·         Aaa authentication login <SSH_list_name> radius local

·         Aaa authentication login <Console_list_name> radius local

·         Aaa authentication enable <SSH_list_name> radius

·         Aaa authentication enable <Console_list_name> radius

·         Line ssh

·         Login authentication <SSH_list_name>

·         Line console

·         Login authentication <Console_list_name>

Note      : Same config works fine in SG350 switches.

                : SG300s are running on 1.4.11.5 (Boot Version: 1.3.5.06)