AAA authentication issue on Cisco 6509 switch.

Matthew Needs · ‎09-21-2012

Hi all. Im having a strange problem on a 6509 switch. I am trying to use a Tekradius Windows2008 server to aaa authenticate switch admin logins.

The Radius server and 6509 loop0 are in a management VRF "netman". I can happily ping to and from the Server and loopback0 interface without issue. I have also tested the radius server account using RadiusNT on a workstation. I get an accept reply with the following variables..

shell:priv-lvl=15

NAS-Prompt

Here are the relevant parts of my config as far as I can see..

aaa new-model

aaa group server radius SRADIUS

server-private 192.168.1.101 auth-port 1812 acct-port 1813 key cisco

ip vrf forwarding netman

ip radius source-interface Loopback0

!

aaa authentication login default group SRADIUS local
aaa authorization exec default group SRADIUS local
aaa accounting system default start-stop group SRADIUS
!
aaa session-id common
!
interface Loopback0
ip vrf forwarding netman
ip address 172.16.17.1 255.255.255.255

Here is a brief overview of my IP setup.

6509 Loop0 - 172.16.17.1 (Radius Source)

Radius Server - 192.168.1.101 (TekRadius)

6509 SVI Interface - 192.168.1.252 (LAN Interface) (also in netman VRF)

Using Wireshark I can see the radius communication to and from the correct IP addresses. However, why do i see "destination unreachable"?. There are no ACL's or firewalls between the Switch and Radius server..

1001 132.049236000 172.16.17.1 192.168.1.101 RADIUS 130 Access-Request(1) (id=219, l=88)

1002 132.062993000 192.168.1.101 172.16.17.1 RADIUS 100 Access-Accept(2) (id=219, l=58)

1003 132.063590000 192.168.1.252 192.168.1.101 ICMP 70 Destination unreachable (Port unreachable)

Here's a radius debug from the 6509.

9w0d: RADIUS: Pick NAS IP for u=0x52001320 tableid=0 cfg_addr=172.16.17.1

9w0d: RADIUS: ustruct sharecount=1

9w0d: Radius: radius_port_info() success=1 radius_nas_port=1

9w0d: RADIUS(00000000): Send Access-Request to 192.168.1.101:1812 id 21645/243,len 77

9w0d: RADIUS: authenticator FF BC 62 A7 54 4F 0E 7F - 3E E5 8D 15 BB 2D AE 16

9w0d: RADIUS: NAS-IP-Address [4] 6 172.16.17.1

9w0d: RADIUS: NAS-Port [5] 6 1

9w0d: RADIUS: NAS-Port-Type [61] 6 Virtual [5]

9w0d: RADIUS: User-Name [1] 7 "cisco"

9w0d: RADIUS: Calling-Station-Id [31] 14 "192.168.2.10"

9w0d: RADIUS: User-Password [2] 18 *

9w0d: RADIUS: Retransmit to (192.168.1.101:1812,1813) for id 21645/243

9w0d: RADIUS: Tried all servers.

9w0d: RADIUS: No valid server found. Trying any viable server

9w0d: RADIUS: Tried all servers.

9w0d: RADIUS: No response from (192.168.1.101:1812,1813) for id 21645/243

9w0d: RADIUS: No response from server

9w0d: RADIUS: Pick NAS IP for u=0x52001320 tableid=0 cfg_addr=172.16.17.1

9w0d: RADIUS: ustruct sharecount=1

9w0d: Radius: radius_port_info() success=1 radius_nas_port=1

9w0d: RADIUS(00000000): Send Access-Request to 192.168.1.101:1812 id 21645/244,len 77

9w0d: RADIUS: authenticator F6 22 C0 76 D3 B5 50 1E - 4A 56 38 F9 DA 73 38 93

9w0d: RADIUS: NAS-IP-Address [4] 6 172.16.17.1

9w0d: RADIUS: NAS-Port [5] 6 1

9w0d: RADIUS: NAS-Port-Type [61] 6 Virtual [5]

9w0d: RADIUS: User-Name [1] 7 "cisco"

9w0d: RADIUS: Calling-Station-Id [31] 14 "192.168.2.10"

9w0d: RADIUS: User-Password [2] 18 *

9w0d: RADIUS: Retransmit to (192.168.1.101:1812,1813) for id 21645/244

9w0d: RADIUS: Tried all servers.

9w0d: RADIUS: No valid server found. Trying any viable server

9w0d: RADIUS: Tried all servers.

9w0d: RADIUS: No response from (192.168.1.101:1812,1813) for id 21645/244

9w0d: RADIUS: No response from server

9w0d: RADIUS: Pick NAS IP for u=0x52001320 tableid=0 cfg_addr=172.16.17.1

9w0d: RADIUS: ustruct sharecount=1

9w0d: Radius: radius_port_info() success=1 radius_nas_port=1

9w0d: RADIUS(00000000): Send Access-Request to 192.168.1.101:1812 id 21645/245,len 77

9w0d: RADIUS: authenticator 27 4F 5F 46 A5 5F D7 40 - 0D 0F 22 9C 44 79 BD F1

9w0d: RADIUS: NAS-IP-Address [4] 6 172.16.17.1

9w0d: RADIUS: NAS-Port [5] 6 1

9w0d: RADIUS: NAS-Port-Type [61] 6 Virtual [5]

9w0d: RADIUS: User-Name [1] 7 "cisco"

9w0d: RADIUS: Calling-Station-Id [31] 14 "192.168.2.10"

9w0d: RADIUS: User-Password [2] 18 *

9w0d: RADIUS: Retransmit to (192.168.1.101:1812,1813) for id 21645/245

9w0d: RADIUS: Tried all servers.

9w0d: RADIUS: No valid server found. Trying any viable server

9w0d: RADIUS: Tried all servers.

9w0d: RADIUS: No response from (192.168.1.101:1812,1813) for id 21645/245

9w0d: RADIUS: No response from server 9w0d: RADIUS: Pick NAS IP for u=0x52001320 tableid=0 cfg_addr=172.16.17.1
9w0d: RADIUS: ustruct sharecount=1
9w0d: Radius: radius_port_info() success=1 radius_nas_port=1
9w0d: RADIUS(00000000): Send Access-Request to 192.168.1.101:1812 id 21645/243,len 77
9w0d: RADIUS: authenticator FF BC 62 A7 54 4F 0E 7F - 3E E5 8D 15 BB 2D AE 16
9w0d: RADIUS: NAS-IP-Address      [4]   6   172.16.17.1
9w0d: RADIUS: NAS-Port            [5]   6   1
9w0d: RADIUS: NAS-Port-Type       [61] 6   Virtual                   [5]
9w0d: RADIUS: User-Name           [1]   7   "cisco"
9w0d: RADIUS: Calling-Station-Id [31] 14 "192.168.2.10"
9w0d: RADIUS: User-Password       [2]   18 *
9w0d: RADIUS: Retransmit to (192.168.1.101:1812,1813) for id 21645/243
9w0d: RADIUS: Retransmit to (192.168.1.101:1812,1813) for id 21645/243
9w0d: RADIUS: Retransmit to (192.168.1.101:1812,1813) for id 21645/243
9w0d: RADIUS: Tried all servers.
9w0d: RADIUS: No valid server found. Trying any viable server
9w0d: RADIUS: Tried all servers.
9w0d: RADIUS: No response from (192.168.1.101:1812,1813) for id 21645/243
9w0d: RADIUS: No response from server
9w0d: RADIUS: Pick NAS IP for u=0x52001320 tableid=0 cfg_addr=172.16.17.1
9w0d: RADIUS: ustruct sharecount=1
9w0d: Radius: radius_port_info() success=1 radius_nas_port=1
9w0d: RADIUS(00000000): Send Access-Request to 192.168.1.101:1812 id 21645/244,len 77
9w0d: RADIUS: authenticator F6 22 C0 76 D3 B5 50 1E - 4A 56 38 F9 DA 73 38 93
9w0d: RADIUS: NAS-IP-Address      [4]   6   172.16.17.1
9w0d: RADIUS: NAS-Port            [5]   6   1
9w0d: RADIUS: NAS-Port-Type       [61] 6   Virtual                   [5]
9w0d: RADIUS: User-Name           [1]   7   "cisco"
9w0d: RADIUS: Calling-Station-Id [31] 14 "192.168.2.10"
9w0d: RADIUS: User-Password       [2]   18 *
9w0d: RADIUS: Retransmit to (192.168.1.101:1812,1813) for id 21645/244
9w0d: RADIUS: Retransmit to (192.168.1.101:1812,1813) for id 21645/244
9w0d: RADIUS: Retransmit to (192.168.1.101:1812,1813) for id 21645/244
9w0d: RADIUS: Tried all servers.
9w0d: RADIUS: No valid server found. Trying any viable server
9w0d: RADIUS: Tried all servers.
9w0d: RADIUS: No response from (192.168.1.101:1812,1813) for id 21645/244
9w0d: RADIUS: No response from server
9w0d: RADIUS: Pick NAS IP for u=0x52001320 tableid=0 cfg_addr=172.16.17.1
9w0d: RADIUS: ustruct sharecount=1
9w0d: Radius: radius_port_info() success=1 radius_nas_port=1
9w0d: RADIUS(00000000): Send Access-Request to 192.168.1.101:1812 id 21645/245,len 77
9w0d: RADIUS: authenticator 27 4F 5F 46 A5 5F D7 40 - 0D 0F 22 9C 44 79 BD F1
9w0d: RADIUS: NAS-IP-Address      [4]   6   172.16.17.1
9w0d: RADIUS: NAS-Port            [5]   6   1
9w0d: RADIUS: NAS-Port-Type       [61] 6   Virtual                   [5]
9w0d: RADIUS: User-Name           [1]   7   "cisco"
9w0d: RADIUS: Calling-Station-Id [31] 14 "192.168.2.10"
9w0d: RADIUS: User-Password       [2]   18 *
9w0d: RADIUS: Retransmit to (192.168.1.101:1812,1813) for id 21645/245
9w0d: RADIUS: Retransmit to (192.168.1.101:1812,1813) for id 21645/245
9w0d: RADIUS: Retransmit to (192.168.1.101:1812,1813) for id 21645/245
9w0d: RADIUS: Tried all servers.
9w0d: RADIUS: No valid server found. Trying any viable server
9w0d: RADIUS: Tried all servers.
9w0d: RADIUS: No response from (192.168.1.101:1812,1813) for id 21645/245
9w0d: RADIUS: No response from server

What am i missing?

Thanks very much for any help guys

Cheers

Matt

dominic.caron · ‎09-24-2012

What is the device at IP 192.168.1.252

Matthew Needs · ‎09-24-2012

Hi Dominic,

It's the 6509's VLAN SVI for the management (Netman VRF) network.. I don't understand why I'm seeing destination unreachable from that particular interface? It's almost like the switch is still sourcing some traffic from the local SVI even though I have specified Loop0 as the radius source, and therfore the radius server is returning the port as closed?

I'm looking into reloading the switch but it's not as easy as it sounds!

Thanks a lot for your help

Matt

dominic.caron · ‎09-24-2012

So...on the SVI interface, you have no ACL because you dont receive message that the packet was filtered. Are you using a pair of 6509 with hsrp or another first-hop protocol?

Matthew Needs · ‎09-24-2012

There is no ACL for sure.. But i am using GLBP, it sounds like you think it may be causing the problems?!.. We have a pair or 6509's.

Thanks again

Matt

dominic.caron · ‎09-24-2012

Can you make a ping form your loopback to the radius server.

Matthew Needs · ‎09-24-2012

Certainly can..

Core_6509A#ping vrf netman 192.168.1.101 source loopback 0

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.101, timeout is 2 seconds:

Packet sent with a source address of 172.16.17.1

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

Core_6509A#

Matt

johnlloyd_13 · ‎09-24-2012

hi matthew,

could you post show run | inc radius?

Jigar Dave · ‎09-24-2012

is there any firewall placed between 6500 switch and radius, if yes, you need to open radius ports 1812 and 1813 (tcp and udp) on that firewall. (bidirectional)