Hi all,I'm configuring a Network Access Control Solution (Packetfence ) but i have a problem to authenticate my users.I hope that someone will be able to help me.-I have a windows 2008 Active Directory for my users -I'm using a cisco 2950 switch to authenticate my users but when connecting a host i get this error on my switch,It seems like the switch cannot reach the server but i'm sure that the radius server ip address is 192.168.10.1 : RADIUS: Retransmit id 400:28:11: RADIUS: Retransmit id 400:28:13: RADIUS: Retransmit id 400:28:15: RADIUS: Marking server 192.168.10.1:1812,1813 dead00:28:15: RADIUS: Tried all servers.00:28:15: RADIUS: No valid server found. Trying any viable server00:28:15: RADIUS: Tried all servers.00:28:15: RADIUS: No response for id 400:28:15: AAA/AUTHEN (3539210218): status = ERROR00:28:15: AAA/AUTHEN/START (3539210218): no methods left to try00:28:15: AAA/AUTHEN (3539210218): status = ERROR00:28:15: AAA/AUTHEN/START (3539210218): failed to authenticate00:28:15: AAA/MEMORY: free_user_quiet (0x80D4E810) user='Prof-PC\Prof' ruser='Prof-PC\Prof' port='FastEthernet0/2' rem_addr='00-40-D0-67-D0-B1/00-18-BA-9B-E7-82' authen_type=6 service=17 priv=1 This is my swicth configuration here : Building configuration... Current configuration : 2480 bytes!version 12.1no service padservice timestamps debug uptimeservice timestamps log uptimeno service password-encryption!hostname Switch!aaa new-modelaaa group server radius packetfence server 192.168.10.1 auth-port 1812 acct-port 1813!aaa authentication login default localaaa authentication dot1x default group packetfenceaaa authorization network default group packetfence!username admin password 0 thegameip subnet-zero!!spanning-tree mode pvstno spanning-tree optimize bpdu transmissionspanning-tree extend system-iddot1x system-auth-control!!!!interface FastEthernet0/1 switchport trunk native vlan 10 switchport trunk allowed vlan 1,10,20,30,40,60,100 switchport mode trunk!interface FastEthernet0/2 switchport access vlan 4 switchport mode access dot1x port-control auto dot1x host-mode multi-host dot1x reauthentication spanning-tree portfast!interface FastEthernet0/3!interface FastEthernet0/4!interface FastEthernet0/5!interface FastEthernet0/6!interface FastEthernet0/7!interface FastEthernet0/8!interface FastEthernet0/9!interface FastEthernet0/10!interface FastEthernet0/11!interface FastEthernet0/12!interface FastEthernet0/13!interface FastEthernet0/14!interface FastEthernet0/15!interface FastEthernet0/16!interface FastEthernet0/17!interface FastEthernet0/18!interface FastEthernet0/19!interface FastEthernet0/20!interface FastEthernet0/21!interface FastEthernet0/22!interface FastEthernet0/23!interface FastEthernet0/24!interface Vlan1 no ip address no ip route-cache shutdown!interface Vlan4 ip address 192.168.4.1 255.255.255.0 no ip route-cache shutdown!interface Vlan10 ip address 192.168.1.5 255.255.255.0 ip helper-address 192.168.10.1 no ip route-cache!interface Vlan20 ip address 192.168.20.1 255.255.255.0 no ip route-cache shutdown!interface Vlan30 ip address 192.168.30.1 255.255.255.0 no ip route-cache shutdown!interface Vlan40 ip address 192.168.40.1 255.255.255.0 no ip route-cache shutdown!interface Vlan50 no ip address no ip route-cache shutdown!interface Vlan60 ip address 192.168.60.1 255.255.255.0 no ip route-cache shutdown!interface Vlan100 ip address 192.168.100.1 255.255.255.0 no ip route-cache shutdown!ip http serverradius-server host 192.168.10.1 auth-port 1812 acct-port 1813 timeout 2 key thegameradius-server retransmit 3radius-server vsa send authentication!line con 0line vty 5 15!!end
hi, network issue is very likely....do you have the required routing to the VLAN on which the RADIUS server lives....can your switch PING the radius server? what source interface are you using for your RADIUS packets from switch to RADIUS server. finally, is the RADIUS server configured to ALLOW the switch to talk RADIUS UDP 1812/1813 to it (iptables, firewalld etc etc) - verify that packets can reach it with eg tcpdump alan
Uh, there's a key labelled "Return" or "Enter" near the right-hand side of your keyboard. Using it once in a while makes your posts much more readable! Stefan On 04.04.16 08:07, TOURE Amidou Florian via Freeradius-Users wrote:
Hi all,I'm configuring a Network Access Control Solution (Packetfence ) but i have a problem to authenticate my users.I hope that someone will be able to help me.-I have a windows 2008 Active Directory for my users -I'm using a cisco 2950 switch to authenticate my users but when connecting a host i get this error on my switch,It seems like the switch cannot reach the server but i'm sure that the radius server ip address is 192.168.10.1 : RADIUS: Retransmit id 400:28:11: RADIUS: Retransmit id 400:28:13: RADIUS: Retransmit id 400:28:15: RADIUS: Marking server 192.168.10.1:1812,1813 dead00:28:15: RADIUS: Tried all servers.00:28:15: RADIUS: No valid server found. Trying any viable server00:28:15: RADIUS: Tried all servers.00:28:15: RADIUS: No response for id 400:28:15: AAA/AUTHEN (3539210218): status = ERROR00:28:15: AAA/AUTHEN/START (3539210218): no methods left to try00:28:15: AAA/AUTHEN (3539210218): status = ERROR00:28:15: AAA/AUTHEN/START (3539210218): failed to authenticate00:28:15: AAA/MEMORY: free_user_quiet (0x80D4E810) user='Prof-PC\Prof' ruser='Prof-PC\Prof' port='FastEthernet0/2' rem_addr='00-40-D0-67-D0-B1/00-18-BA-9B-E7-82' authen_type=6 service=17 priv=1
This is my swicth configuration here : Building configuration... Current configuration : 2480 bytes!version 12.1no service padservice timestamps debug uptimeservice timestamps log uptimeno service password-encryption!hostname Switch!aaa new-modelaaa group server radius packetfence server 192.168.10.1 auth-port 1812 acct-port 1813!aaa authentication login default localaaa authentication dot1x default group packetfenceaaa authorization network default group packetfence!username admin password 0 thegameip subnet-zero!!spanning-tree mode pvstno spanning-tree optimize bpdu transmissionspanning-tree extend system-iddot1x system-auth-control!!!!interface FastEthernet0/1 switchport trunk native vlan 10 switchport trunk allowed vlan 1,10,20,30,40,60,100 switchport mode trunk!interface FastEthernet0/2 switchport access vlan 4 switchport mode access dot1x port-control auto dot1x host-mode multi-host dot1x reauthentication spanning-tree portfast!interface FastEthernet0/3!interface FastEthernet0/4!interface FastEthernet0/5!interface FastEthernet0/6!interface FastEthernet0/7!interface FastEthernet0/8!interface FastEthernet0/9!interface FastEthernet0/10!interface FastEthernet0/11!interface FastEthernet0/12!interface FastEthernet0/13!interface FastEthernet0/14!interface FastEthernet0/15!interface FastEthernet0/16!interface FastEthernet0/17!interface FastEthernet0/18!interface FastEthernet0/19!interface FastEthernet0/20!interface FastEthernet0/21!interface FastEthernet0/22!interface FastEthernet0/23!interface FastEthernet0/24!interface Vlan1 no ip address no ip route-cache shutdown!interface Vlan4 ip address 192.168.4.1 255.255.255.0 no ip route-cache shutdown!interface Vlan10 ip address 192.168.1.5 255.255.255.0 ip helper-address 192.168.10.1 no ip route-cache!interface Vlan20 ip address 192.168.20.1 255.255.255.0 no ip route-cache shutdown!interface Vlan30 ip address 192.168.30.1 255.255.255.0 no ip route-cache shutdown!interface Vlan40 ip address 192.168.40.1 255.255.255.0 no ip route-cache shutdown!interface Vlan50 no ip address no ip route-cache shutdown!interface Vlan60 ip address 192.168.60.1 255.255.255.0 no ip route-cache shutdown!interface Vlan100 ip address 192.168.100.1 255.255.255.0 no ip route-cache shutdown!ip http serverradius-server host 192.168.10.1 auth-port 1812 acct-port 1813 timeout 2 key thegameradius-server retransmit 3radius-server vsa send authentication!line con 0line vty 5 15!!end - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Stefan Winter -
TOURE Amidou Florian