10-07-2022 03:14 AM
I have AIR-AP1242AG-S-K9 standalone access point. It has radius server group configured but no radius server configured under the group. But still it authenticates the users. I'm trying to figure out how it authenticate the users. Below is the output,
Cisco-floor1-ap07#show radius server-group all
Sever group rad_eap
Sharecount = 1 sg_unconfigured = FALSE
Type = standard Memlocks = 1
- Is there any bug in the model of access point which make access point not to show the radius server in config?
- If there is no radius server under radius group, users authenticate automatically?
10-07-2022 06:26 AM
Can you share your SSID configuration?
Please note, this is an extremely old AP and a lot of documentation doesn't anymore exist for this device.
10-08-2022 02:57 AM
Like @patoberli said this AP is long past end of support and will be running VERY old IOS.
Bugs are very likely - but without seeing your full config showing SSID, aaa and radius config from the AP it's impossible to comment. On older IOS radius config sometimes wasn't even in a group so you might be using standalone radius config.
You can easily check on your radius server whether they are getting authenticated by the server and you could run a debug on the AP too.
Some versions of IOS did have a bug where they didn't display aaa config correctly in show commands.
10-09-2022 10:47 PM
@patoberli @Rich R Thanks for your inputs. Below is the radius and aa config of the access point. Pls note I cannot see "radius server host xxxx " command in the configuration.
aaa group server radius radius_eap
!
aaa authentication login default group tacacs+ local
aaa authentication login Console line
aaa authentication login eap_method group radius_eap
aaa authorization config-commands
aaa authorization exec default group tacacs+
aaa authorization commands 0 default group tacacs+ none
aaa authorization commands 1 default group tacacs+ none
aaa authorization commands 15 default group tacacs+ none
aaa accounting commands 15 default start-stop group tacacs+
aaa cache profile admin_cache
!
aaa session-id common
!
dot11 ssid lobby11
authentication open eap eap_method
authentication network-eap eap_method
mobility network-id 700
!
dot11 ssid lobby12
authentication open eap eap_method
authentication network-eap eap_method
mobility network-id 800
10-10-2022 12:03 AM
Nothing in your config starting with "radius-server host"?
What does "show aaa servers" show?
Agreed that config doesn't look right though.
Did you run debug?
Did you check on the radius server?
10-10-2022 01:36 AM
Nothing in your config starting with "radius-server host"? Unfortunately no
What does "show aaa servers" show? No results
Did you run debug? yes. user associated and dissociated logs. no IP address.
Did you check on the radius server? we have many auth servers in our evnvironments
10-10-2022 05:54 AM
Well then it doesn't sound like your users are being authenticated by radius and the debug should have told you how they are being authenticated.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide