fast Ethernet 0 fails as a radius source interface

[SMD28316]

I am trying to test radius connection, I have a simple AAA setup to authenticate with Dot1X, First I used VLAN1 as a source-interface which worked, then tested changing to fastethernet0 on two 2960X switches and RADIUS is starting to fail on one of them.

I checked the interfaces properties and I can see that the "bad" switch has 0 hits on cache, diff output:

    FastEthernet0-Physical buffers, 1524 bytes (total 32, permanent 32):^M
          24 in free list (0 min, 32 max allowed)^M
          8 hits, 0 fallbacks^M
          8 max cache size, 8 in cache^M
    -     0 hits in cache, 0 misses in cache
    +     70223883 hits in cache, 0 misses in cache

Is this related to my issue? how do I troubleshoot this?

[Georg Pauwen]

Hello,

on the 2960X, the FastEthernet0 is what, a layer 2 or layer 3 interface ?

[SMD28316]

layer 3 interfaces, config:

interface FastEthernet0
description MGMT-int
- ip address <ip_address> 255.255.255.0
description MGMT-int
+ ip address <ip_address> 255.255.255.0
no ip route-cache

[SMD28316]

- is for the bad switch and the + is for the good switch, the other lines are shared

[balaji.bandi]

what was the VLAN 1 IP addres that worked ? have you assigned same Address to FastEthernet 0 ? where is radius server what IP address ?

If you make fast 0 is  router interface, that should be up and running ? ( what port it connected other side ?)

[SMD28316]

interface Vlan1
- no ip address
+ ip address <IP_ADDR> 255.255.0.0
shutdown

Fast etherenet 0 on the BAD switch has an IP address different from the VLAN 1, is this an issue? since VLAN1 is down on both switches.

and radius server is a standalone ISE node that I use for my experiments.

" If you make fast 0 is  router interface, that should be up and running ? ( what port it connected other side ?) " I don't understand the question, you mean make the interface a layer 3 interface? because it already is.

[balaji.bandi]

when you configure Fas 0 IP address, is the interface up or down ?

if that is different IP address, using that source IP are you able to reach ISE ?

post the full configuration to understand (rather - and + it confusing here)

" If you make fast 0 is  router interface, that should be up and running ? ( what port it connected other side ?) " I don't understand the question, you mean make the interface a layer 3 interface? because it already is.

if the interface not connected, how will the interface up, and IP address will be active ?

[SMD28316]

FastEthernet is up on both switches, I didn't check if ISE is reachable via fast ethernet 0, can I ping with specifying the interface?

the configuration for both interfaces:

interface FastEthernet0
description MGMT-BAD
ip address <IP_ADDR> 255.255.255.0
no ip route-cache

interface FastEthernet0
description MGMT-GOOD
ip address <IP_ADDR> 255.255.255.0
no ip route-cache

[balaji.bandi]

we need to know what is Good IP full (hope that is private IP so that not secret right ?) what is ISE IP address

try ping x.x.x.x(ise ip ) source fast0  see if that works ?

[Richard Burts]

You tested radius and it worked using the IP of vlan 1. Then you changed and used the IP of fasteth0. Was the IP address the same address as vlan 1 or a different address? If you used a different IP address does the radius server have the new IP configured as a client?

If you used the same IP address on both interfaces then the results of ping to the radius address using the source as fasteth0 would be interesting.

If the ping is not successful then it might be helpful to see the output of show ip interface brief and of show ip route from the switch (and an indication of the IP address of radius).

It might also be helpful to check the logs of the radius server. Does it see the request from your switch? Does it think it responded to your switch?