C3650 radius authentication not working but in 2960x works

[raziel.valdez]

C3650 radius authentication not working but in 2960x works

aaa new-model
!
!
aaa authentication login AAA_RADIUS group radius local
aaa authorization exec AAA_RADIUS group radius local
aaa authorization network AAA_RADIUS group radius local
!
!
!
!
!
!
aaa session-id common
boot system switch all flash:cat3k_caa-universalk9.16.12.08.SPA.bin
boot system switch all flash:packages.conf
boot system switch all flash:cat3k_caa-universalk9.16.06.08.SPA.bin
clock timezone UTC 8 0
switch 2 provision ws-c3650-24ts
!
!

!
!
radius server AAARAD
address ipv4 10.29.30.12 auth-port 1645 acct-port 1646
key Mykey
!
!line con 0
exec-timeout 0 0
logging synchronous
stopbits 1
line aux 0
stopbits 1
line vty 0 4
authorization exec AAA_RADIUS
login authentication AAA_RADIUS
transport input ssh
line vty 5 15
transport input ssh
!

[balaji.bandi]

Is this for device Authentication right ?

Try changing the  radius server name and match correct one.

no radius server AAARAD

radius server AAA_RADIUS
address ipv4 10.29.30.12 auth-port 1645 acct-port 1646
key Mykey

[raziel.valdez]

snmp-server host 10.100.48.253 version 2c R3publ1cC3m3nt snmp
!
!
radius server AAA_RADIUS
address ipv4 10.29.30.12 auth-port 1645 acct-port 1646
key Mykey
!
!
control-plane
service-policy input system-cpp-policy
!

still the same after changing the name

[balaji.bandi · Accepted solution]

ok what is the error you getting on client end when you try to login using SSH ?

what logs you see on the Cisco Switch console ?  (make sure the radius server reachable and client added to Radius Server) - Hope you change the switch and using same IP ?

%RADIUS-4-RADIUS_DEAD: RADIUS server 10.29.30.12:1645,1646 is not responding.

You have issue reaching the radius server, so check the source interface added to reach the Radius. (source Interface IP should be added to Radius Server)

ip radius source-interface Loopback0  (example loopback0 10.10.10.10 to be added to radius)

what is the output :

show aaa servers

[raziel.valdez]

you are right switch is not sending request to radius server that's why there's no logs coming out on the radius server

RADIUS: id 4, priority 1, host 10.29.30.12, auth-port 1645, acct-port 1646
State: current UP, duration 253s, previous duration 0s
Dead: total time 0s, count 114
Platform State from SMD: current UP, duration 378s, previous duration 0s
SMD Platform Dead: total time 0s, count 0
Platform State from WNCD: current UP, duration 0s, previous duration 0s
Platform Dead: total time 0s, count 0
Quarantined: No
Authen: request 8, timeouts 8, failover 0, retransmission 6
Response: accept 0, reject 0, challenge 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 2
Throttled: transaction 0, timeout 0, failure 0
Author: request 0, timeouts 0, failover 0, retransmission 0
Response: accept 0, reject 0, challenge 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 0
Throttled: transaction 0, timeout 0, failure 0
Account: request 0, timeouts 0, failover 0, retransmission 0
Request: start 0, interim 0, stop 0
Response: start 0, interim 0, stop 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms

this solved my issue at first i misconfigured the vlan on the command ip radius source-interface . 

i used the vlan id of my server vlan, but it should be the management vlan of the switch

vlan 131: management vlan

vlan 100 : server vlan

ip radius source-interface vlan 131

so i used the correct one ip radius source-interface vlan  131

thanks everyone for the big help appreciate you all for your time on answering. 

[M02@rt37]

Hello @raziel.valdez 

Does the C3650 ping the RAD server ?

Default ports for RADIUS authentication and accounting are 1812 and 1813, respectively. Do you try these ports instead of 1645 and 1646.

You could also debug this issue thanks to this command:

debug aaa authentication

[raziel.valdez]

i tired to change the port still same.. also for the debug aaa, no output shown

*Feb 15 14:45:21.642 UTC: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.29.30.12:1645,1646 is not responding.
*Feb 15 14:45:21.642 UTC: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.29.30.12:1645,1646 is being marked alive.

[M02@rt37]

Thanks @raziel.valdez for that output.

*Feb 15 14:45:21.642 UTC: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.29.30.12:1645,1646 is not responding.

Radius on a windows Server? NPS configured ? Do you check that configuration ? Possible to see error/log on that Radius server ?

[raziel.valdez]

I can ping my radius server.. please do take note that my command is working on my 2960x devices..  

3650, 3750 model doesn't work but all the commands is in there

[MHM Cisco World]

Check

Radius source-interface vlanx

Add vlan x SVI to radius network device 

If not work can you confirm if there is FW or not in path to radius?

MHM

[MHM Cisco World]

Under line vty 5 15 add same command 

line vty 5 15

authorization exec AAA_RADIUS
login authentication AAA_RADIUS

Then check again 

MHM

[raziel.valdez]

line vty 0 4
authorization exec AAA_RADIUS
login authentication AAA_RADIUS
transport input ssh
line vty 5 15
authorization exec AAA_RADIUS
login authentication AAA_RADIUS
transport input ssh
!

still same 

Keyboard-interactive authentication prompts from server:
| Password:
End of keyboard-interactive prompts from server
Access denied
Keyboard-interactive authentication prompts from server:
| Password:

[MHM Cisco World]

I dont think it is radius issue it ssh issue

Add telent to vty line and check

MHM

[liviu.gheorghe]

Is the 3560 added as a network device in the Radius server?

[Aref Alsouqi]

I'm assuming that you added the 3650 and the 3750 have been added to NPS as clients, and that there is no firewall in between the switches and NPS. In the shared config snippet it doesn't show the RADIUS server group name, I'm assuming you have created one? if so, please try to replace the "radius" keyword in the following commands to be the RADIUS server group name you created:

aaa authentication login AAA_RADIUS group radius local
aaa authorization exec AAA_RADIUS group radius local