cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
939
Views
0
Helpful
2
Replies

ACI and Freeradius

lnrdnl78d
Level 1
Level 1

Hi Dears,

did someone meet troubles to deploy authentication of ACI using Freeradius ?
We're deploying it for a customer but ever receive "authentcation reject".
On Freeradius (owner is customer) as av-pairs we asked to configure
following, as we need only one role with full privilege.

 

file:/etc/freeradius/clients.conf

client *.*.*.* {
        type            = acct
        secret          = *****************
        shortname       = Cisco
        nastype         = cisco
        require_message_authenticator = no
}

________________________________________

file: /etc/freeradius/users

User_User                      MD5-Password := ""**************************""
                                Service-Type = NAS-Prompt-User,
                                cisco-avpair = 'shell:roles=\"network-admin\"',
                                Cisco-avpair += "shell:domains = all/aaa/read-all(16001)",
                                cisco-avpair += "shell:priv-lvl=15"

User_User.aci                  MD5-Password := "**************************"
                                Cisco-avpair = "shell:domains = all/admin"



That Freeradius is already used to authenticate access to other device (Cisco too) and at begin customer tried to add av-pair to user but then He created a new user (User_User.aci) for test purpose.

 

Some Idea ?

Thanks in advance

Daniele

 

2 Replies 2

Francesco Molino
VIP Alumni
VIP Alumni
Hi

Have you tried to return shell:domains = all//admin instead of single /.

Also can you check the file /var/log/dme/log/nginx.bin.log to see what it shows when you try to authenticate?

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

Sig Nine
Level 1
Level 1
Hello, Daniele.

Is it possible to try the following settings?

User_User       MD5-Password := ""**************************""
                Service-Type = NAS-Prompt-User,
                cisco-avpair = 'shell:roles=\"network-admin\"',
                Cisco-avpair += "shell:domains = all/aaa/read-all/(16001)",
                cisco-avpair += "shell:priv-lvl=15"

User_User.aci   MD5-Password := "**************************"
                Cisco-avpair = "shell:domains = all/admin/(16002)"
 
Regards,
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Save 25% on Day-2 Operations Add-On License