Description

RADIUS Authentication is not working and need to find a way to troubleshoot this

Symptoms

  • Customer is trying to configure RADIUS authenication with ACS 4.2. I
  • Configured the RADIUS settings on the SRX 240. but the ACS server shows a failure code, External DB password invalid.
  • Tested RADIUS auth with other firewalls SSG and ASA's, so the ACS server is fine.

Solution


Currently, there are no traceoptions available to determine why external authentication will not work when trying to log into a device for admin purposes.

The messages log will be able to give you some symptoms or clues as to why the authentication is failing. 

Example: 

Apr 23 23:39:46 DGIF-001-FW-1 sshd[91172]: Failed password for support from 10.1.1.68 port 1811 ssh2
Apr 23 23:46:21 DGIF-001-FW-1 sshd: Access-Reject: E=691 R=0 V=3 M=Authentication Failed^R^LRejected ^M
Apr 23 23:46:21 DGIF-001-FW-1 sshd: unrecognized attribute in Access-Reject: 18

Additionally, tcpdump can be run at the shell level, to provide packet dumps which aid in the troubleshooting efforts.  Make sure tcpdump is issued by specifying snaplength of 65535 (otherwise, you won't get the data you intended to capture)

Example: 
root@srx210% tcpdump -i ge-0/0/1.0 -s 65535 host 10.1.1.68
verbose output suppressed, use <detail> or <extensive> for full protocol decode
Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on ge-0/0/1.0, capture size 65535 bytes

Reverse lookup for 10.1.1.68 failed (check DNS reachability).
Other reverse lookup failures will not be reported.
Use <no-resolve> to avoid reverse lookups on IP addresses.

12:19:38.557360 Out IP dhcp-172-22-134-149.jnpr.net.54250 > 10.1.1.68.radius: RADIUS, Access Request (1), id: 0x74 length: 57
12:19:38.576161 In IP 10.1.1.68.radius > dhcp-172-22-134-149.jnpr.net.54250: RADIUS, Access Accept (2), id: 0x74 length: 87
^C
228 packets received by filter
0 packets dropped by kernel
root@srx210%