topic Re: Radius Message from NPS in ICX Switches

Radius Message from NPS

Ingatel — Tue, 18 Jun 2024 10:01:16 GMT

I've got a Wired 802.1x implementation with a ruckus switch as the Radius client and a Microsoft NPS acting as the Radius server.

The below config line on the switch is the one causing me a lot of grief and I see a constant error showing up on Event Viewer on my NPS.

---------------------------------------------------------------------------------------------------------------------------------

radius-server host 192.168.100.251 auth-port 1812 acct-port 1813 default key Mykeyrds dot1x

------------------------------------------------------------------------------------------------------------------------------------

Error on NPS: A RADIUS message with the Code field set to 12, which is not valid, was received on port 1813 from RADIUS client My ICX switch. Valid values of the RADIUS Code field are documented in RFC 2865.

Switch ICX 7150 version is 09.0.10c

How do I stop the switch from sending the Code field 12 thing to my NPS???

Re: Radius Message from NPS

Trev — Tue, 18 Jun 2024 16:17:48 GMT

We've got exactly the same issue on ICX7150's on Ruckus One with SPS09010h_cd2 firmware.

Any help here please Ruckus?

Re: Radius Message from NPS

Chandini — Tue, 18 Jun 2024 17:26:05 GMT

Hi Ingatel

Thank you for reaching us

If the query is only with respect to code field set to 12 error received and there is no issue noticed then as per RFC its a experimental feature and should not cause any impact.

Code 12 and 13 as per RFC is experimental. Code 12 field maps to status-server(experimental).

The only code field which would be important would be Access-Request, Access-Accept, Access-Reject and Access-Challenge (Codes 1, 2, 3, and 11) and Accounting-Request and Accounting-Response packets (Codes 4 and 5).

Link referred : https://datatracker.ietf.org/doc/html/rfc2865

Status-Server packets are sent by a RADIUS client to a RADIUS server in order to test the status of that server and should not cause a problem.

For now there is no available command in the switch which could help disable them but there would be no issue noticed with respect to traffic in the network.

Let me know if this helps address your concern

Thanks

Re: Radius Message from NPS

Ingatel — Wed, 19 Jun 2024 07:16:02 GMT

Hi Chandini,

The problem is that the Windows Server 2019 event viewer fills up with these errors.

Is there any plan to implement a command later that resolves by disabling code 12?

Is there also a way to filter it in the NPS so that it is not detected as an error?

Re: Radius Message from NPS

Chandini — Wed, 19 Jun 2024 08:57:40 GMT

Hi Ingatel

Ack and Thank you for reaching us

Let me check about this with the team for 9010 version code. I'll post here once I have a update.

Thanks

Re: Radius Message from NPS

Ingatel — Wed, 19 Jun 2024 09:15:50 GMT

Hi Chandini,

I look forward to receiving your response

Thanks

Re: Radius Message from NPS

BenBeck — Mon, 16 Sep 2024 17:42:12 GMT

Adding a note here. ICX7150 support is planned to be added in 10010f this fall. 7150 is currently not supported in 10.x, however. 10010f will have the ability to disable this. Hope this helps!

Re: Radius Message from NPS

josue_jimenez_c — Thu, 10 Oct 2024 19:23:04 GMT

Hello there,

The RADIUS status-server packet checks the availability or status of the RADIUS server. This can generate a high number of log messages on the server side. To disable these log messages, use the radius-server host status-server command. By default, the server status logs are enabled.

On 10.0.10d and later this command disables those status-server off

device(config)# radius-server host 1.1.1.1 auth-port 1812 acct-port 1813 default key anu dot1x mac-auth web-auth no-login port-only status-server off

docs.commscope.com/bundle/fastiron-10010-securityguide/page/GUID-D0272DF4-9309-4EBE-8320-C41B8090E7B9.html