Aruba & ProVision-based
cancel
Showing results for 
Search instead for 
Did you mean: 

Aruba/RADIUS: Switch doesnt authenticate with MS-CHAPv2, but with PAP

 
SOLVED
Go to solution
IT_Student
Regular Visitor

Aruba/RADIUS: Switch doesnt authenticate with MS-CHAPv2, but with PAP

Hello everyone, 

we have a problem with a few of our switches, which do not authenticate at the radius server with peap as configured. This is my configuration: 

radius-server host [IP] key [key]

aaa authentication ssh login peap-mschapv2 local

aaa authentication ssh enable peap-mschapv2 local

aaa authentication login privilege-mode

All of the switches are configured like this. But as I said, some of them dont authenticatie the user. They can definitely reach the NPS, because when I switch over to 'aaa authentication ssh radius local' (PAP), everything works fine. 

I can´t link this problem to a software release or product series, becuase for every failing switch, I can find a working switch with the exact same model and the same os version (or even older). What they all have in common is the product series 2530. 

On the NPS, there is only one rule, that basically allows every authentication method (for testing). From the logs I can see, that the switch and server are starting the Access-Request / Access-Challenge ping-pong. This usually ends with an Access-Accept packet, but in this case, they simply abort the connection. The server also doesn´t send an Access-Rejected packet. 

Does someone have an idea? Thank you in advane. 

 

3 REPLIES 3
IT_Student
Regular Visitor
Solution

Re: Aruba/RADIUS: Switch doesnt authenticate with MS-CHAPv2, but with PAP

Hello again, 

I could reslolve the issue. The problem was that obviously,  NPS is checking the timestamp of the event when using EAP, but is not when using PAP. On the failing switches, sntp was not configured, so the switches did not have the right system time. Adding a sntp server resolved this for me. 

nikunjbhatia
HPE Pro

Re: Aruba/RADIUS: Switch doesnt authenticate with MS-CHAPv2, but with PAP

Hi 

 

Please let me know if Adding a sntp server has resolved you issue.

In case you need any other assistance do let us know. 

I am a HPE Employee
Accept or Kudo
IT_Student
Regular Visitor

Re: Aruba/RADIUS: Switch doesnt authenticate with MS-CHAPv2, but with PAP

Yes, it resolved the issue. 

Thank you!