AAA Authentication to mange switch

[Andrew_Schulz]

I have a 3500yl that I want to setup RADIUS to require a domain login (primary) when managing the swtich, local as secondary. I have a Windows IAS server where I created a new Access Policy with Windows-Groups, Unencrypted authentication and service-type RADIUS Standard Login.

On the switch I've setup AAA Authentication server and see the following information.

Status and Counters - General RADIUS Information

Deadtime(min) : 0
Timeout(secs) : 3
Retransmit Attempts : 2
Global Encryption Key :
Dynamic Authorization UDP Port : 3799
Source IP Selection : Outgoing Interface

Auth Acct DM/ Time |
Server IP Addr Port Port CoA Window | Encryption Key OOBM
--------------- ---- ---- --- ------ + -------------------------------- ----
10.0.0.10 1645 1646 No 300 | xxxxxxx No

******************************************************************************** 

Status and Counters - Authentication Information

Login Attempts : 2
Respect Privilege : Disabled

| Login Login Login
Access Task | Primary Server Group Secondary
----------- + ---------- ------------ ----------
Console | Local None
Telnet | Local None
Port-Access | Local None
Webui | Radius radius Local
SSH | Local None
Web-Auth | ChapRadius radius None
MAC-Auth | ChapRadius radius None
SNMP | Local None

| Enable Enable Enable
Access Task | Primary Server Group Secondary
----------- + ---------- ------------ ----------
Console | Local None
Telnet | Local None
Webui | Radius radius Local
SSH | Local None

********************************************************************************

Status and Counters - RADIUS Server Information

Server IP Addr : 10.0.0.10

Authentication UDP Port : 1645 Accounting UDP Port : 1646
Round Trip Time : 0 Round Trip Time : 0
Pending Requests : 0 Pending Requests : 0
Retransmissions : 6 Retransmissions : 0
Timeouts : 9 Timeouts : 0
Malformed Responses : 0 Malformed Responses : 0
Bad Authenticators : 0 Bad Authenticators : 0
Unknown Types : 0 Unknown Types : 0
Packets Dropped : 0 Packets Dropped : 0
Access Requests : 3 Accounting Requests : 0
Access Challenges : 0 Accounting Responses : 0
Access Accepts : 0
Access Rejects : 0

I am not able to login to the Webui with my domain account which I know is in the group assigned to the IAS policy. It appears to attempt authentication from the above log but it just redirects back to the login screen.

I've reviewed several documents on this and just need a little help to get this configured. 

• ftp://ftp.hp.com/pub/networking/software/3500-5400-6200-ASG-0207-K.12.XX-Book.pdf
• http://h40060.www4.hp.com/procurve/uk/en/pdfs/application-notes/AN-S1_Web-Authentication-final-080608.pdf

Thanks

[Andrew_Schulz]

Quick update. I enabled | login for Telnet and when attempting to login I get - Can't reach RADIUS server.
No server(s) responding.

However, once I login with the local account I can verify that I am able to ping the radius server from the switch. Also the UDP port I am using 1645 is open as I use it with my Cisco routers.

[Makana1980]

Can post your AAA configuration part?  pls

this lines should be configured

radius-server host 192.168.XXX.XXX key "secret"

aaa authentication telnet login radius local
aaa authentication telnet enable radius local

[Andrew_Schulz]

Here is what I have in the config for AAA 

radius-server host 10.0.0.10 key xxxxx
radius-server timeout 3
radius-server retransmit 2
aaa authentication num-attempts 2
aaa authentication telnet login radius local
aaa authentication telnet enable radius local

[Andrew_Schulz]

Finally got it working, it was a painfully stupid mistake on my part. Fat fingered the shared secret.