topic Re: AAA authentication in ICX Switches

AAA authentication

whisler_soineus — Thu, 13 Feb 2020 19:41:25 GMT

Can't login using AAA radius to a ICX 7450-24. It displays the error when enter credentials and press return/enter : access denied by radius server. What should I set on radius server to get the AAA authentication working please

Re: AAA authentication

james_schena — Thu, 13 Feb 2020 19:53:54 GMT

Do you have the Vendor specific information entered to the RADIUS server?

Check this out: http://docs.ruckuswireless.com/fastiron/08.0.80/fastiron-08080-securityguide/GUID-945A5436-ED61-497F...

Re: AAA authentication

netwizz — Thu, 13 Feb 2020 20:06:28 GMT

What RADIUS server do you have? I only ask because the instructions to configure it are different.

Re: AAA authentication

whisler_soineus — Fri, 14 Feb 2020 13:45:41 GMT

My radius server is windows 2019

Re: AAA authentication

whisler_soineus — Fri, 14 Feb 2020 13:49:35 GMT

Yes I've followed that topic to enter Vendor specific to Radius Server. But I don't know why it rejects the request access.

Do you have information about how to configure NPS server ( Connection request access policy and network policy) on windows 2019? Thanks

Re: AAA authentication

james_schena — Fri, 14 Feb 2020 14:20:04 GMT

the NPS server should be as follows:
create policy for IPv4 address pool (I have found that it works best to create 1 policy per subnet)
create policy for windows accounts to have access(we create a network admin group and give vendor specific attributes as follows:
Vendor code 1991, yes to permit attribute 1, decimal, 0.
Next vendor code 1991, yes, 2, whois* 1.
Next vedor code 1991, yes, 3, decimal, 0

check all encryption types.

Harder to explain, much easier to show....
try this video: https://www.youtube.com/watch?v=KAGEA7OnPvY

Re: AAA authentication

netwizz — Fri, 14 Feb 2020 14:32:02 GMT

Yes, but mine is on an older sever version... I looked at some screenshots, and they look the same, so I suspect this may work. Your Millage May Vary.

Also if you use this for other stuff, no promises the Network Policies wont potentially break other connection requests depending upon the processing order, etc.

I am looking at an old 2012 r2 box that was decommissioned that I had this working on...

Under NPS > Policies > Connection Request Profiles

I created a Policy called ICX Request
Policy State -> Policy Enabled CHECKED
Type of network access server -> Unspecified

Conditions TAB: Client Vendor -> RADIUS Standard

Settings Tab: Authentication Methods ->ALL unchecked
Authentication -> Authenticate requests on this server

Everything else is blank

***

Under NPS > Policies > Network Policies
I created one named "ICX Admin Level"

Policy State -> Policy Enabled CHECKED
Overview Tab:
Access Permission -> Grant access SELECTED
Type of network access server -> Unspecified
Conditions Tab:
Conditions: Windows Groups Value:YOURDOMAN\Network Admins (or whatever group you want)

Constraints Tab:
Authentication Methods:
EAP Types -> [Blank]
Less secure authentication methods:
Microsoft Encrypted Authentication Version 2 (MS-CHAP-v2) CHECKED
Microsoft Encrypted Authentciation (MS-CHAP) CHECKED
Unencrypted authentication (PAP,SPAP) CHECKED

Settings Tab:
Standard-> Framed-Protocol PPP (The attribute number is 7, and it is listed under commonly used for Dial-Up or VPN)
Standard->Framed (attribute is 6, and it is listed under commonly used for dial-up VPN)

Vendor Specific -> Vendor: Vendor Code 1991 Value: 0
On the Add/Edit button
Enter Vendor Code SELECTED 1991
Yes, It conforms SELECTED then click Change Attribute button

This oppens Configure VSA (RFC Compliant)
Vendor-assigned attribute number: 1
Attribute format: Decimal
Attribute value: 0

NPS Enforcement:
Allow full network access

Encryption: ALL are checked

***

Creaet a NEW RADIUS client for your switches. Technically you can even use a subnet if you wish, but for now just use an IP (or DNS)

I like to generate a key because they are nice and complex like Wtws5JjQMsf8tnd^fO6oR82zEVl#4MCJYB&kQsuKS2FFg!IO@OWu7CyevweUVvQe

At any rate, make sure the client is enabled and that it is set to RADIUS Standard on the other tab.

****

On the switch:

hostname yourhostname
username backup password yourpassword_if_RADIUS_Breaks

crypto key zeroize rsa
crypto key zeroize dsa
crypto key generate rsa mod 2048


crypto-ssl certificate generate

radius-server host 10.1.2.3
radius-server key Wtws5JjQMsf8tnd^fO6oR82zEVl#4MCJYB&kQsuKS2FFg!IO@OWu7CyevweUVvQe


aaa authentication web-server default local
aaa authentication enable default radius local
aaa authentication login default radius local
aaa authentication login privilege-mode


enable aaa console

console timeout 30
ip dns domain-list yourdomain.tld
ip dns server-address 10.4.5.6 10.7.8.9
no telnet server

clock summer-time
clock timezone us Eastern
!
!
ntp
 server 10.1.2.3
!
!
exit
no web-management http
web-management https

ip access-list standard 99
permit host 10.10.11.12
!
ssh access-group 99
web access-group 99
!
!

ip ssh  authentication-retries 2
ip ssh  timeout 30
ip ssh  idle-time 30
ip ssh  scp disable
ip ssh  encryption disable-aes-cbc
!

Re: AAA authentication

whisler_soineus — Fri, 14 Feb 2020 14:46:30 GMT

Ok, I'm gonna to try this, I will let you know. Thanks you

Re: AAA authentication

whisler_soineus — Fri, 14 Feb 2020 16:36:49 GMT

HI, I have my windows server configured exactly as it is showed on your post, if before I could not get any error message from the sever, now I have one : 'The connection request did not match any configured network policy.
reason code 49.'
I've already to review in many manners the network policy but the same error message appears.

Re: AAA authentication

whisler_soineus — Fri, 14 Feb 2020 16:52:24 GMT

HI guys, it's working now.
Thanks you.