Re: Remote Radius Authentication

fdogarcia · ‎03-15-2011

I have my remote config is the same with my local config

but when I try to use the remote radius authentication is fail ?

I need to config my remote with other command? to acces like the local to the same Radius Server

PTS_COP_3750#sh run
!

enable secret 5 $1$iPLp$E7wVNrPansomXV6LUbRQQ.
!
username pts-admin privilege 15 secret 5 $1$pEaG$kV7V8Yxc1mB3LXPnnwM4h/
!
!
aaa new-model
!
!
aaa authentication login default group radius local
aaa authorization console
aaa authorization exec default group radius local
!
!
!
aaa session-id common
clock timezone EST -5
clock summer-time EDT recurring
switch 1 provision ws-c3750-24ts
switch 2 provision ws-c3750-24ts
switch 3 provision ws-c3750g-24t
!
!
access-list 10 permit 172.20.1.34 log
access-list 10 remark VTY_ALLOWED
access-list 10 permit 172.20.1.9 log
access-list 10 permit 172.25.0.100 log
access-list 10 permit 172.20.0.100 log
access-list 10 permit 172.25.1.89 log
access-list 10 permit 172.20.5.0 0.0.0.255 log
access-list 10 permit 172.25.5.0 0.0.0.255 log
access-list 10 deny any log
!
!
radius-server host 172.20.1.34 auth-port 1812 acct-port 1813 key 7 000601070A5F12041A22471E59
radius-server retransmit 1
radius-server timeout 3
!
!
line con 0
exec-timeout 9 0
logging synchronous
line vty 0 4
access-class 10 in
exec-timeout 9 0
logging synchronous
length 0
transport input ssh
line vty 5 15
access-class 10 in
exec-timeout 9 0
logging synchronous
transport input ssh
!
Mar 15 12:31:02: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: spyders] [Source: 172.20.1.9] [localport: 22] [Reason: Login Authentication Failed] at 12:31:02 EDT
Tue Mar 15

Mar 15 12:58:20: %SEC-6-IPACCESSLOGS: list 10 permitted 172.20.1.9 2 packets
Mar 15 12:58:26: RADIUS/ENCODE(000000CC): ask "Password: "
Mar 15 12:58:26: RADIUS/ENCODE(000000CC):Orig. component type = EXEC
Mar 15 12:58:26: RADIUS: AAA Unsupported Attr: interface         [171] 4
Mar 15 12:58:26: RADIUS:   74 74                [ tt]
Mar 15 12:58:26: RADIUS/ENCODE(000000CC): dropping service type, "radius-server attribute 6 on-for-login-auth" is off
Mar 15 12:58:26: RADIUS(000000CC): Config NAS IP: 0.0.0.0
Mar 15 12:58:26: RADIUS/ENCODE(000000CC): acct_session_id: 16
Mar 15 12:58:26: RADIUS(000000CC): sending
Mar 15 12:58:26: RADIUS/ENCODE: Best Local IP-Address 192.168.91.2 for Radius-Server 172.20.1.34
Mar 15 12:58:26: RADIUS(000000CC): Send Access-Request to 172.20.1.34:1812 id 1645/40, len 95
Mar 15 12:58:26: RADIUS: authenticator 21 A0 2F 0E 1C 24 E5 D6 - 1F 47 27 8B C6 02 55 46
Mar 15 12:58:26: RADIUS: User-Name           [1]   9   "spyders"
Mar 15 12:58:26: RADIUS: Reply-Message       [18] 12
Mar 15 12:58:26: RADIUS:   50 61 73 73 77 6F 72 64 3A 20        [ Password: ]
Mar 15 12:58:26: RADIUS: User-Password       [2]   18 *
Mar 15 12:58:26: RADIUS: NAS-Port            [5]   6   2
Mar 15 12:58:26: RADIUS: NAS-Port-Id         [87] 6   "tty2"
Mar 15 12:58:26: RADIUS: NAS-Port-Type       [61] 6   Virtual                   [5]
Mar 15 12:58:26: RADIUS: Calling-Station-Id [31] 12 "172.20.1.9"
Mar 15 12:58:26: RADIUS: NAS-IP-Address      [4]   6   192.168.91.2
Mar 15 12:58:26: RADIUS(000000CC): Started 3 sec timeout
Mar 15 12:58:28: RADIUS(000000CC): Request timed out
Mar 15 12:58:28: RADIUS: Retransmit to (172.20.1.34:1812,1813) for id 1645/40
Mar 15 12:58:28: RADIUS(000000CC): Started 3 sec timeout
Mar 15 12:58:31: RADIUS(000000CC): Request timed out
Mar 15 12:58:31: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.20.1.34:1812,1813 is not responding.
Mar 15 12:58:31: %RADIUS-4-RADIUS_ALIVE: RADIUS server 172.20.1.34:1812,1813 is being marked alive.
Mar 15 12:58:31: RADIUS: No response from (172.20.1.34:1812,1813) for id 1645/40
Mar 15 12:58:31: RADIUS/DECODE: parse response no app start; FAIL
Mar 15 12:58:31: RADIUS/DECODE: parse response; FAIL
Mar 15 12:58:33: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: spyders] [Source: 172.20.1.9] [localport: 22] [Reason: Login Authentication Failed] at 12:58:33 EDT Tue Mar 15 2011
----------------------------------------------------------------------------------------------------------------------------------------------

local

PTS_ASH_3750#sh run
enable secret 5 $1$Gy03$gL4iojW4YXCIFGT22cwmT0
!
username pts-admin privilege 15 secret 5 $1$7Xfy$9LP0u0/Q/e//Xxak1kg49/
!
!
aaa new-model
!
!
aaa authentication login default group radius local
aaa authorization console
aaa authorization exec default group radius local
!
!
!
aaa session-id common

!
access-list 10 permit 172.20.1.34 log
access-list 10 remark VTY_ALLOWED
access-list 10 permit 172.20.1.9 log
access-list 10 permit 172.25.0.100 log
access-list 10 permit 172.20.0.100 log
access-list 10 permit 172.25.1.89 log
access-list 10 permit 172.20.5.0 0.0.0.255 log
access-list 10 permit 172.25.5.0 0.0.0.255 log
access-list 10 deny any log
!
!
radius-server host 172.20.1.34 auth-port 1812 acct-port 1813 key 7 000601070A5F12041A22471E59
radius-server retransmit 1
radius-server timeout 3
!
line con 0
exec-timeout 9 0
logging synchronous
line vty 0 4
access-class 10 in
exec-timeout 9 0
logging synchronous
length 0
transport input ssh
line vty 5 15
access-class 10 in
exec-timeout 9 0
logging synchronous
transport input ssh
!
!

Mar 15 13:13:27: RADIUS/ENCODE(00000137): ask "Password: "
Mar 15 13:13:27: RADIUS/ENCODE(00000137):Orig. component type = EXEC
Mar 15 13:13:27: RADIUS: AAA Unsupported Attr: interface         [171] 4
Mar 15 13:13:27: RADIUS:   74 74                [ tt]
Mar 15 13:13:27: RADIUS/ENCODE(00000137): dropping service type, "radius-server attribute 6 on-for-login-auth" is off
Mar 15 13:13:27: RADIUS(00000137): Config NAS IP: 0.0.0.0
Mar 15 13:13:27: RADIUS/ENCODE(00000137): acct_session_id: 18
Mar 15 13:13:27: RADIUS(00000137): sending
Mar 15 13:13:27: RADIUS/ENCODE: Best Local IP-Address 172.20.1.100 for Radius-Server 172.20.1.34
Mar 15 13:13:27: RADIUS(00000137): Send Access-Request to 172.20.1.34:1812 id 1645/24, len 95
Mar 15 13:13:27: RADIUS: authenticator 07 62 03 19 EF 65 54 3B - 91 1A 96 07 50 0E 5C 24
Mar 15 13:13:27: RADIUS: User-Name           [1]   9   "spyders"
Mar 15 13:13:27: RADIUS: Reply-Message       [18] 12
Mar 15 13:13:27: RADIUS:   50 61 73 73 77 6F 72 64 3A 20        [ Password: ]
Mar 15 13:13:27: RADIUS: User-Password       [2]   18 *
Mar 15 13:13:27: RADIUS: NAS-Port            [5]   6   1
Mar 15 13:13:27: RADIUS: NAS-Port-Id         [87] 6   "tty1"
Mar 15 13:13:27: RADIUS: NAS-Port-Type       [61] 6   Virtual                   [5]
Mar 15 13:13:27: RADIUS: Calling-Station-Id [31] 12 "172.20.1.9"
Mar 15 13:13:27: RADIUS: NAS-IP-Address      [4]   6   172.20.1.100
Mar 15 13:13:27: RADIUS(00000137): Started 3 sec timeout
Mar 15 13:13:28: RADIUS: Received from id 1645/24 172.20.1.34:1812, Access-Accept, len 51
Mar 15 13:13:28: RADIUS: authenticator C1 DD 83 73 48 44 39 6A - BF 0F A9 93 9B 04 61 8C
Mar 15 13:13:28: RADIUS: Service-Type        [6]   6   Login                     [1]
Mar 15 13:13:28: RADIUS: Vendor, Cisco       [26] 25
Mar 15 13:13:28: RADIUS:   Cisco AVpair       [1]   19 "shell:priv-lvl=15"
Mar 15 13:13:28: RADIUS(00000137): Received from id 1645/24
Mar 15 13:13:28: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: spyders] [Source: 172.20.1.9] [localport: 22] at 13:13:28 EDT Tue Mar 15 2011
PTS_ASH_3750#

Atif Awan · ‎03-15-2011

Have you verified reachability between your router and the radius server? From the debugs it seems the router is not getting a response back from the radius server and that could be either a reachability issue or a configuration issue at the radius server side. Check the following:

Make sure you are sourcing the radius packets with the IP Address defined as the 'client' in radius. From degbus the router is using 192.168.91.2 as the radius source IP Address. Issue a ping from the router to the radius server to verify reachability 'ping 172.20.1.34 source 192.168.91.2'.
If reachability is fine then you will need to check the radius configuration. It should have the router's IP Address defined as a radius client for it to send a response back to the router.

If both of the above look good then send us the debugs from the radius end as well.

Atif