I'd have something like: radius-server host 192.168.1.50 auth-port 1812 acct-port 1813 key <shared-secret> radius-server timeout 2 radius-server deadtime 1 radius-server vsa send authentication ! aaa new-model ! ! aaa group server radius RADIUS-SERVERS server 192.168.1.50 auth-port 1812 acct-port 1813 ! aaa authentication dot1x default group RADIUS-SERVERS aaa accounting dot1x default start-stop group RADIUS-SERVERS ! dot1x system-auth-control dot1x guest-vlan supplicant ! int fa0/1 dot1x pae authenticator dot1x port-control auto dot1x host-mode multi-host dot1x timeout quiet-period 5 dot1x timeout server-timeout 5 dot1x timeout reauth-period server dot1x timeout tx-period 5 dot1x timeout supp-timeout 5 dot1x max-req 1 dot1x max-reauth-req 1 dot1x reauthentication dot1x guest-vlan 100 dot1x auth-fail vlan 100
-----Original Message----- From: freeradius-users- bounces+s.p.armitage=lboro.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+s.p.armitage=lboro.ac.uk@lists.freeradius.org] On Behalf Of Omar Lopez Limonta Sent: 25 April 2008 09:36 To: FreeRadius users mailing list Subject: Re: Dot1x on cisco 3560
On Fri, Apr 25, 2008 at 9:51 AM, <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
xxxx Cleartext-Password := "PPPPPl" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
this sort of stuff it for admin access to the switch
Sending Access-Challenge of id 60 to 172.29.11.1:21645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010300160410245db5b7205b11398ead15f567f6ed77 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb307e1b51eedc6cc895b65e64bcd34a3 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.29.11.1:21645, id=60, length=123 Sending duplicate reply to client authenticator-short-name:21645 - ID: 60 Re-sending Access-Challenge of id 60 to 172.29.11.1:21645
lots of these. looks like FR is sending challenges but the switch is not responding. whats your IOS config look like? if you 'debug aaa' on the switch can you see stuff happening at all?
Mmmm is curious: 04-25-2008 10:27:16 Local7.Warning 172.29.11.1 67648: 070624: *Apr 14 13:06:59: %RADIUS-4-RADIUS_ALIVE: RADIUS server 172.29.11.7:1812,1813 has returned. 04-25-2008 10:27:16 Local7.Warning 172.29.11.1 67647: 070623: *Apr 14 13:06:59: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.29.11.7:1812,1813 is not responding. Using debug in AAA on my switch.
I have this radius settings on my cisco switch:
#sh run | include radius aaa authentication dot1x default group radius aaa authorization network default group radius radius-server host 172.29.11.7 auth-port 1812 acct-port 1813 timeout 3 radius-server key mecago #
Any other line could be necessary ?
I´m using MD5 challenge because i´m testing and i don´t want deploy certificates or certificate server. Are you using MS certificate Server with FR?
-- Xgalaga se disfruta más sobre NetBSD sparc64
Content Rules:
///// \\\/// ///\\\ The Duke of Url. { O--O } / /\ \ \ -- / [||]
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html