AAA with RADIUS server not working

aocferreiraaocferreira Member Posts: 50 ■■■□□□□□□□

I'm trying to get one of my routers to authenticate the telnet connections with a machine with FreeRadius installed.

R2#show run | inc aaa
aaa new-model
aaa authentication login CISCO group radius local
aaa session-id common

R2#show run | inc radius
aaa authentication login CISCO group radius local
radius-server host auth-port 1645 acct-port 1646 key cisco

R2#show run | section line vty
line vty 0 4
login authentication CISCO
transport input telnet ssh

I downloaded FreeRadius and after a little bit of search online it seems only client and user must be added from config point of view:

client {
secret = cisco
shortname = R2

andre User-Password == "teste"

Anyway, this is not working. I got "Authentication failed" when I telnet to R2

Sniffing the interface with wireshark I can actually see Access-Request packets coming to laptop, so I would say that something is missing on Radius side.
Anyone has this working that can help here?



  • mackenzaemackenzae Member Posts: 77 ■□□□□□□□□□
    Did you verify if the FreeRadius server is listening on those ports?
  • AMD4EVERAMD4EVER Member Posts: 64 ■■□□□□□□□□
    To verify that this is a problem with Radius, all you'd need to change is the lines below and then try logging in using local authentication. If that works then you know the problem is somehow Radius related.

    no aaa authentication login CISCO group radius local
    aaa authentication login CISCO group local

    You could also just run a "debug radius" and see what is going on with authentication
  • DCDDCD Member Posts: 473 ■■■■□□□□□□
    Is you firewall on or open to those port numbers?
  • aocferreiraaocferreira Member Posts: 50 ■■■□□□□□□□
    According to debug messages, it seems definetely RADIUS problem.. I've been trying but can't make it work:

    *Feb 19 00:14:35.066: AAA/AUTHEN/LOGIN (00000063): Pick method list 'RADIUSAUTH'
    *Feb 19 00:14:35.066: RADIUS/ENCODE(00000063): ask "Password: "
    *Feb 19 00:14:35.066: RADIUS/ENCODE(00000063): send packet; GET_PASSWORD
    *Feb 19 00:14:51.126: RADIUS/ENCODE(00000063):Orig. component type = EXEC
    *Feb 19 00:14:51.126: RADIUS: AAA Unsupported Attr: interface [174] 6
    *Feb 19 00:14:51.126: RADIUS: 74 74 79 31 [tty1]
    *Feb 19 00:14:51.126: RADIUS/ENCODE(00000063): dropping service type, "radius-server attribute 6 on-for-login-auth" is off
    *Feb 19 00:14:51.126: RADIUS(00000063): Config NAS IP:
    *Feb 19 00:14:51.126: RADIUS/ENCODE(00000063): acct_session_id: 99
    *Feb 19 00:14:51.126: RADIUS(00000063): sending
    *Feb 19 00:14:51.130: RADIUS/ENCODE: Best Local IP-Address for Radius-Server
    *Feb 19 00:14:51.130: RADIUS(00000063): Send Access-Request to id 1645/16, len 87
    *Feb 19 00:14:51.130: RADIUS: authenticator CF E2 4B BE 68 13 FC 4B - 14 22 A2 B6 63 61 B2 AF
    *Feb 19 00:14:51.130: RADIUS: User-Name [1] 11 "aferreira"
    *Feb 19 00:14:51.130: RADIUS: User-Password [2] 18 *
    *Feb 19 00:14:51.130: RADIUS: NAS-Port [5] 6 194
    *Feb 19 00:14:51.130: RADIUS: NAS-Port-Id [87] 8 "tty194"
    *Feb 19 00:14:51.130: RADIUS: NAS-Port-Type [61] 6 Virtual [5]
    *Feb 19 00:14:51.130: RADIUS: Calling-Station-Id [31] 12 ""
    *Feb 19 00:14:51.130: RADIUS: NAS-IP-Address [4] 6
    *Feb 19 00:14:55.398: RADIUS: Retransmit to (,1812) for id 1645/16
    *Feb 19 00:14:59.974: %RADIUS-4-RADIUS_DEAD: RADIUS server,1812 is not responding.
    *Feb 19 00:14:59.974: %RADIUS-4-RADIUS_ALIVE: RADIUS server,1812 is being marked alive.
    *Feb 19 00:14:59.974: RADIUS: Retransmit to (,1812) for id 1645/16
    *Feb 19 00:15:04.390: RADIUS: Retransmit to (,1812) for id 1645/16
    *Feb 19 00:15:09.254: RADIUS: No response from (,1812) for id 1645/16
    *Feb 19 00:15:09.254: RADIUS/DECODE: No response from radius-server; parse response; FAIL
    *Feb 19 00:15:09.254: RADIUS/DECODE: Case error(no response/ bad packet/ op decode);parse response; FAIL

    *Feb 19 00:15:11.258: AAA/AUTHEN/LOGIN (00000063): Pick method list 'RADIUSAUTH'
    *Feb 19 00:15:11.262: RADIUS/ENCODE(00000063): ask "Password: "
    *Feb 19 00:15:11.262: RADIUS/ENCODE(00000063): send packet; GET_PASSWORD
  • DCDDCD Member Posts: 473 ■■■■□□□□□□
    I don't know how you have this set up but you have your radius-serve set to but the client is at Can both devices ping each other?
  • AMD4EVERAMD4EVER Member Posts: 64 ■■□□□□□□□□
    If you can't ping the RADIUS server from the router then check for routing issues. If you can't ping the router from the RADIUS server then make sure the gateway is configured properly on the RADIUS server and that an ACL isn't blocking traffic on the router. If both of those are working then I'd check to make sure the RADIUS server is configured to use port 1812 for RADIUS and again look to make sure no ACLs are negatively affecting this traffic.
Sign In or Register to comment.