Description

This article provides detailed Information on:

  • Radius/TACACS+ & ACS configuration
  • Radius/TACACS+ & ACS troubleshooting

Symptoms

Diagram:

Admin trying to login to the Access-Switch using RADIUS user.

Diagram Description automatically generated with medium confidence
 

Solution

Radius Configuration

  • Configure the IPv4 address of the RADIUS authentication server
set system radius-server 172.16.12.25
 
  • Configure the port which will be used by the switch to contact the RADIUS Server
set system radius-server 172.16.12.25 port 1812
 
  • Configure the shared secret password that network device uses to authenticate with RADIUS server. it should be same on both the Switch & RADIUS Server
set system radius-server 172.16.12.25 secret $ABC123
 
  • Configure the dedicated source address for RADIUS server so that the switch can use the source address to communicate with the RADIUS instead of a random interface IP
set system radius-server 172.16.12.25 source-address 10.208.10.30
 
  • Configure the authentication order (RADIUS is configured primary authentication method & Local password as the backup authentication method).
set system authentication-order radius
set system authentication-order password
 
  • To use different login classes for different RADIUS-Authenticated users, granting them different permissions
set system login user RO uid 2001 class read-only
set system login user SU uid 2002 class super-user
set system login user OP uid 2003 class operator
set system login user Remote uid 2004 class read-only
 
  • Configure the IP address for the Accounting server.
set system accounting destination radius server 172.16.12.25
 
  • Configure the shared secret password that the network device uses to authenticate with the Accounting server. It should be same on both the switch & Accounting sever. 
set system accounting destination radius server 172.16.12.25 secret “$ABC123"
 
  • Configure the events to audit or to be logged in Accounting server.
Set system accounting events [ login change-log interactive-commands ]
  1. Login - Audit Logins
  2. Change-log - Audit Configuration changes
  3. Interactive-commands - Audit interactive commands (any command-line input)

 

  • Configure the port which will be used by the switch to contact the Accounting server
set system radius-server 172.16.12.25 port 1813
 
  • Configure the dedicated source address for Accounting server so that the switch can use the source address to communicate with the Accounting instead of a random interface IP
set system accounting destination radius server 172.16.12.25 source-address 10.208.10.30
 

Troubleshooting

  • Check if the RADIUS/Accounting is configured as per given configuration.
  • Check if the RADIUS/Accounting is reachable
    • Ping the RADIUS/Accounting server IP address to verfity the reachability.
    • Traceroute the RADIUS/Accounting server IP address to check if the traffic is getting dropped at a particular next-hop or not (Considering there is no rule applied to hide the ICMP traffic or next-hop)
Ping 172.16.12.25 source 10.208.10.30
Traceroute 172.16.12.25 source 10.208.10.30
 
  • Check if there are any policies on the RADIUS/Accounting server that rejects authentication requests from the switch.
  • Check if there is any firewall filter is configured to block the RADIUS/Accounting dedicated traffic (Source-IP of RADIUS/Accounting-IP, Destination-IP of RADIUS/Accounting-IP, Destination-Port of RADIUS/Accounting Server are meant to be accepted or included in allowed terms).
Show configuration | display set |match <source-ip/destination-ip/destination-port_of_RADIUS/Accounting_server>
 
  • Check if the secret is configured or not under radius-server/accounting-server hierarchy. Also check if the secret has unsupported special characters.
  • Check if upstream devices are not blocking RADIUS/Accounting requests from the source-switch.
  • Try restarting the authentication service.
restart general-authentication-service gracefully
 
  • Monitor the RADIUS/Accounting traffic on the interface that should send & receive packets towards the RADIUS/Accounting server & check that RADIUS packets are sent/received?
monitor traffic interface XE-0/2/0 matching "port 1812/1813"
monitor traffic interface XE-0/2/0 matching "host 172.16.12.25"
 
  • Use the trace-options to capture/debug on the general-authentication-services with all flags enabled. Check if the switch is sending & receiving packets towards the RADIUS/Accounting server & check that RADIUS/Accounting packets are sent/received.
set system processes general-authentication-service traceoptions file radius
set system processes general-authentication-service traceoptions flag all
 

Verify RADIUS services

  • Command will display the RADIUS server status & information
show network-access aaa radius-server

Modification History

non-technical edits