Zulzig
1 Copper

Pwerconnect 5448, Windows Server 2008 R2

Jump to solution

Hello from France,

One of my project for a customer is to create a secure authentification via 802.1X. I chose to use freeradius.

But the customer didn't want to integrate a linux solution.

So I switched to Microsoft Windows server 2008 R2 and the NPS. I set up two solutions

First, a NAP. The solution works without any problems.

But the second, configuring dell powerconnect  device to a authenticate via active active directory has not working. I found and tried many howtos on the web, but no one are compliant with my device.

someone have to deploy this solution with the NAP  of Microsoft? Is there a POC from dell, which allow to solve it ? 

Thank for your helps

Théo

0 Kudos
1 Solution

Accepted Solutions
Moderator
Moderator

Re: Pwerconnect 5448, Windows Server 2008 R2

Jump to solution

I have been looking through the information here, and I am not seeing anything that would can change to the switch configuration . Everything works fine until we add the Windows RADIUS into the mix. With the Wireshark you are even seeing the request make it to the server, but then the server never sent a packet back to authenticate the user and the switch timed out for authentication and logged it as rejected.

Daniel Covey
Dell EMC| Enterprise Support Services
Get support on Twitter:@DellCaresPRO
Download our QRL app:iOS, Android, Windows
Dell Networking Resources

0 Kudos
7 Replies
Moderator
Moderator

Re: Pwerconnect 5448, Windows Server 2008 R2

Jump to solution

What does the configuration on the switch look like?

What firmware is the switch currently at?

One thing to look for is to see if dot1x legacy-supp-mode is enabled. If it is, then NAP won’t authenticate successfully.

I have not personally set this up before, but I can certainly help look through the configuration and see if we can spot some suggested changes.

Cheers.

Daniel Covey
Dell EMC| Enterprise Support Services
Get support on Twitter:@DellCaresPRO
Download our QRL app:iOS, Android, Windows
Dell Networking Resources

0 Kudos
Highlighted
Zulzig
1 Copper

Re: Pwerconnect 5448, Windows Server 2008 R2

Jump to solution

Hello Daniel,

Thank for your questions

the switch is running with this firmware: 

SW version    2.0.0.46 ( date  14-Apr-2011 time  13:10:53 )

my radius configuration:

radius-server host 172.168.16.1 key Testing123 usage login

aaa authentication enable EN_RADIUS radius enable

aaa authentication login AUTH_RADIUS radius local

line ssh

login authentication AUTH_RADIUS

enable authentication EN_RADIUS

exit

my server configuration

I use this how to: http://www.darylhunter.me/blog/2010/06/dell-powerconnect-radius-windows-server-2008-nps.html

log on the switch:

14-May-2013 21:58:50 :%AAA-W-REJECT: New ssh connection for user usertest, source 192.168.2.200 destination 192.168.5.234  REJECTED

logs on the NPS:

"MS-AD","IAS",05/14/2013,21:58:09,1,"usertest",,,,,,,"192.168.5.234",,0,"192.168.5.234","Powerconnect4448",,,,,,,,,0,"311 1 172.168.16.1 05/07/2013 12:09:50 23",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

"MS-AD","IAS",05/14/2013,21:58:09,3,,,,,,,,,,0,"192.168.5.234","Powerconnect4448",,,,,,,,,49,"311 1 172.168.16.1 05/07/2013 12:09:50 23",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

For the NAP, all it's OK, all computer on the domain are matched in the right rule. I can see it on the NPS logs file. And I watched radius transaction with wireshark.

Cheers

0 Kudos
Moderator
Moderator

Re: Pwerconnect 5448, Windows Server 2008 R2

Jump to solution

Thank you for the extra information. The firmware looks to be up to date, which is good. To help me understand the issue better, I would like to clarify a couple things. With this configuration in place, your clients are able to authenticate on the port and have connectivity? The issue comes up when trying to SSH to the server itself to manage it? Or do I have this wrong?

Thanks

Daniel Covey
Dell EMC| Enterprise Support Services
Get support on Twitter:@DellCaresPRO
Download our QRL app:iOS, Android, Windows
Dell Networking Resources

0 Kudos
Zulzig
1 Copper

Re: Pwerconnect 5448, Windows Server 2008 R2

Jump to solution

Yes, when i would like to log with my AD account over SSH on the switch, the switch reject my request.

Without radius authentification, i can to log on the switch with SSH.

log on the switch:

15-May-2013 16:38:44 :%AAA-I-CONNECT: User CLI session for user admin over ssh , source 192.168.5.254 destination  192.168.5.234 ACCEPTED

Before using the Microsoft solution, I was set up the freeradius solution, which worked fine.

i have the intention to use wireshark, in the goal to watch, the radius transaction between the switch and the server.

thank

0 Kudos
Moderator
Moderator

Re: Pwerconnect 5448, Windows Server 2008 R2

Jump to solution

Thank you for the extra clarification. Next lets take a look at the output from the following show command.

Console# show authentication methods

On our 2008 server do we have the $enab15$  user created?

Daniel Covey
Dell EMC| Enterprise Support Services
Get support on Twitter:@DellCaresPRO
Download our QRL app:iOS, Android, Windows
Dell Networking Resources

0 Kudos
Zulzig
1 Copper

Re: Pwerconnect 5448, Windows Server 2008 R2

Jump to solution

# show authentication methods

Login Authentication Method Lists

----------------------------------

Console_Default     : None

Network_Default     : Local

console             : Local

RADIUS_LOG          : Radius   Local    Enable

Enable  Authentication Method Lists

----------------------------------

Console_Default     : Enable   None

Network_Default     : Enable

console             : Enable

RADIUS_EN           : Radius   Enable

Line           Login Method List         Enable Method List

-------        -----------------         -------------------

Console        Default                   console

Telnet         Default                   Default

SSH            RADIUS_LOG                console

http                : Local

on my windows server, i have created the $enab15$ account.

With whireshark I have a radius request, when i would like to log on my switch.

I think that Microsoft radius technologies, is not compliant with my switch..

0 Kudos
Moderator
Moderator

Re: Pwerconnect 5448, Windows Server 2008 R2

Jump to solution

I have been looking through the information here, and I am not seeing anything that would can change to the switch configuration . Everything works fine until we add the Windows RADIUS into the mix. With the Wireshark you are even seeing the request make it to the server, but then the server never sent a packet back to authenticate the user and the switch timed out for authentication and logged it as rejected.

Daniel Covey
Dell EMC| Enterprise Support Services
Get support on Twitter:@DellCaresPRO
Download our QRL app:iOS, Android, Windows
Dell Networking Resources

0 Kudos