Secondary Local Authentication Failed

[seanhwee]

Hi,

I am trying to setup a radius authentication against Windows NPS using our AD credential. For this part its working well. Problem I am having is the secondary login which is the local account. I am using a ProCurve J9022A Switch 2810-48G Software revision N.11.52

Error from log;-

auth: Invalid user name/password on SSH session

Config;-

aaa authentication login privilege-mode
aaa authentication telnet login radius local
aaa authentication telnet enable radius local
aaa authentication ssh login radius local
aaa authentication ssh enable radius local
radius-server key password123
radius-server host 10.10.10.10

Show Authentication;-

Status and Counters - Authentication Information

  Login Attempts : 3   Respect Privilege : Enabled

                           | Login      Login      Enable     Enable  

Access Task  | Primary    Secondary  Primary    Secondary

----------- + ---------- ---------- ---------- ----------  

Console          | Local      None       Local      None  

Telnet             | Radius     Local      Radius     Local  

Port-Access | Local  

Webui             | Local      None       Local      None  

SSH                  | Radius     Local      Radius     Local  

Web-Auth     | ChapRadius  

MAC-Auth     | ChapRadius

Any help on why radius authentication is working but not the secondary local authentication?

[Neil_Salmon]

You need to create local users on the switch, i.e.

password manager username fred

you will then be prompted to create a password for the manager account, this will be the fall-back credentials if the remote (Radius) authentication server is not available.

[Chrisd131313]

The secondary method is only for a fallback scenario, it will not work if teh NPS server is online. You would need to disable the NPS service on the NPS server to test the secondary method - or block the ports you have radius listening on (1812/1645 as default). As long as the NPS server responds to the radius auth request from the switch it will check against the NPS policies and not fallback to local switch authentication even if the user attempting to login is not in the group you have setup in the policy.

HTH