Description

This article describes the issue of Radius Authentication failure on Junos and how to troubleshoot this issue.

Symptoms

User Authentication was failing locally on the Junos Router, even though the Radius server was able to successfully authenticate the user. The Customer was able to confirm this via the Radius server logs.

The following logs, which were obtained from the Junos device, are for the xyz user. The first logs clearly indicate that the local-id was not configured. In the second line, it is clear that the authentication failure occurred for the xyz user.

Jun 9 09:11:43 abc-Border-01 sshd[74778]: User 'remote' authenticated successfully but no local login-id configured.
Jun 9 09:11:43 abc-Border-01 sshd: SSHD_LOGIN_FAILED: Login failed for user 'xyz' from host '10.3.7.9'

Solution

In the configuration, the xyz local user has not been defined under the device's system configuration or generic profile (such as remote): 

class engineering {
    idle-timeout 30;
    permissions all;
}
class noc {
    idle-timeout 30;
    permissions [ view view-configuration ];
}
user admin {
    uid 200;
    class Engineering;
    authentication {
}
   }
user noc {
    uid 101;
    class noc;
}
}

For more information, refer to the following link:

http://www.juniper.net/techpubs/en_US/junos12.1/topics/example/authentication-configuration-tacacs-radius-password-configuring.html

To resolve this issue, as per the above technical example, the xyz user or remote profile must be locally configured.

Related Information