Test AAA issue

[michaelglosker]

Hello everyone!

I'm currently in the process of setting up AAA (Authentication, Authorization, and Accounting) on my Cisco Catalyst 9300 Switch to establish communication with a Windows NPS server.

Once the configuration was completed on both ends, I attempted to use the command "test aaa new radius username password new-code" and received a successful result. However, upon inspecting the logs on the NPS side, specifically the Audit success log, I noticed that the Authentication type used was PAP.

I'm curious as to why PAP was employed. Is it the default authentication type? Additionally, I'd like to know if there's a more secure way to perform a AAA test, considering that PAP transmits passwords in clear text.

Another question is, is there a way to test AAA from a specific interface?

The commands I utilized to configure the switch were:

- aaa new-model

- aaa authentication dot1x default group radius

- dot1x system-auth-control

[Flavio Miranda · Accepted solution]

Hi

 "'m curious as to why PAP was employed. "

  For simplicity as it allows you to use username and password.  It would not be easy to test using certificate for example. But it does not mean this is the authentication method for production. 

"Another question is, is there a way to test AAA from a specific interface?"

Yes, just use the command:

 ip tacacs source-interface <layer3 interface / vlan>

[MHM Cisco World · Accepted solution]

the radius send clear text 
tacacs send password/username with hash in end of packet for security 

ip tacacs/radius source-interface <IP> <<- this IP will always use for connect to AAA and for test AAA

More about tacacs secuirty.

https://security.stackexchange.com/questions/173445/how-exactly-does-tacacs-encryption-work

[pokhrelaj]

Hi Michael,

Can you please share the configuration? I am setting up AAA  on my Cisco Catalyst 9300 Switch to establish communication with a Windows NPS server. Every time I get User authentication request was rejected by the server with the test command. Also, I have configured a port with dot1x but it's not even getting an IP address. Please help.

Regards,

Aj

[MHM Cisco World]

Make new post  please 

Thanks 

MHM