Unsolved

This post is more than 5 years old

17 Posts

2195

May 3rd, 2018 08:00

R1-2210 VRTX RADIUS

Hey guys,

I'm slowly trawling through our network switches and securing them off. As part of this process RADIUS is being configured, I've done most of our switches now but the VRTX switch is being a pain. I get a rejection message on the switch and RADIUS authenticates the user fine with event ID 6278. I've removed IP's and keys for security.

%AAA-W-REJECT: New ssh connection, source   destination    REJECTED

Here is my configuration.

aaa authentication login default radius local
aaa authentication enable default none
ip http authentication aaa login-authentication radius local
!
radius-server host 
 
   key 
  
    radius-server host 
   
     key 
    
      ! line console login authentication default enable authentication default exec-timeout 60 exit line ssh login authentication default enable authentication default exec-timeout 60 exit
    
   
  
 

I started to think there was a management access class somewhere so set one up but it made no difference.

management access-list secure-mgmt
 permit service ssh
 permit service http
 permit service https
 permit ip-source 
 
   service snmp
 permit ip-source 
  
    service snmp exit management access-class secure-mgmt
  
 

Any ideas what's going on?

Moderator

 • 

9.6K Posts

 • 

44 Points

May 3rd, 2018 11:00

Hi,

Is it able to ping the radius server? Does show radius-servers show the server?

17 Posts

May 3rd, 2018 15:00

I wish it was so easy, the RADIUS request is received and accepted by the RADIUS server with the correct policy. The user is authenticated on RADIUS OK.

The RADIUS servers can be pinged and show up with the "show radius-servers" command.

17 Posts

May 3rd, 2018 15:00

Done, thanks for picking this up.

Moderator

 • 

9.6K Posts

 • 

44 Points

May 3rd, 2018 15:00

Can you private message me the service tag?

Moderator

 • 

9.6K Posts

 • 

44 Points

May 3rd, 2018 16:00

Was ssh working before Radius was enabled? Does show ip ssh show it enabled? Which firmware version is the switch running? Show version should tell us the version. If you use console access instead of ssh does it authenticate.

17 Posts

May 14th, 2018 13:00

Hi Josh, sorry it took me so long, I went away on holiday. Yes SSH works fine with or without RADIUS enabled, I can connect fine, I just get the authentication issue as described. If I turn radius on for the web only for example then I can still get in fine with SSH, it's the RADIUS config on the switch I believe as the RADIUS server seems happy enough and accepts the request. The software version is 2.0.0.52 the boot code is 2.0.0.1. Does the configuration in this thread look good to you? 

Moderator

 • 

9.6K Posts

 • 

44 Points

May 14th, 2018 13:00

The radius configuration looks fine.

17 Posts

May 14th, 2018 13:00

Any ideas then? Is it possible the VRTX switch requires a particular RADIUS attribute to be sent back to the switch? Other switch vendors need this, no other DELL does I'm aware of but this switch is fairly unique!

Moderator

 • 

9.6K Posts

 • 

44 Points

May 14th, 2018 14:00

There were some fixes for radius in later updates, so we would recommend updating to the latest switch version. http://www.dell.com/support/home/us/en/04/drivers/driversdetails?driverId=1XTJX

 

17 Posts

May 15th, 2018 16:00

Ok no worries, will try that and report back. It may be some time as it will need to be done during a maintenance window.

0 events found

No Events found!

Top