Solved

Nexus 5010 AAA Radius Authentication Issue

Posted on 2010-11-12
1
1,275 Views
Last Modified: 2012-05-10
I am able to ping the radius server 172.20.xx.10 from the vrf managment interface which is on a different subnet.  However when I try to autheticate I simply get AAA servers unreachable. Please look at code and advise. I have a 2008 r2 server with NPS running for the Radius and all my other switches are working fine off of it. Been scratching my head on this one. Thanks. --Rob.

 
STP-C5010-01# sh run

version 4.1(3)N2(1)

no feature telnet

no telnet server enable

feature interface-vlan



role name default-role

  description This is a system defined role and applies to all users.

  rule 5 permit show feature environment

  rule 4 permit show feature hardware

  rule 3 permit show feature module

  rule 2 permit show feature snmp

  rule 1 permit show feature system

username admin password 5 $1$7e6okdrX$HKYXI6FbU5RyLZRpgpUr.0  role network-admi

ssh key rsa 2048

ip host STP-C5010-01 172.20.68.1

radius-server host 172.20.xx.10 key 7 "xxx" authentication account

ng

aaa group server radius useRadius

    server 172.20.xx.10

    use-vrf management

switchname STP-C5010-01

snmp-server user admin network-admin auth md5 0x0372c0bb76f8b6b8ab016ee85049e11

 priv 0x0372c0bb76f8b6b8ab016ee85049e11b localizedkey

snmp-server host 172.20.xx.238 traps version 1 xxx ntp server 132.148.x.253 use-vrf management

aaa authentication login default group useRadius

aaa authentication login error-enable

radius-server directed-request



vrf context management

  ip route 0.0.0.0/0 172.20.68.250

vlan 1,68



interface Vlan1



interface Vlan68

  no shutdown

  ip address 172.20.xx.10/24



interface Ethernet1/1

  speed 1000



interface Ethernet1/2



interface Ethernet1/3



interface Ethernet1/4



interface Ethernet1/5



interface Ethernet1/6



interface Ethernet1/7



interface Ethernet1/8

  switchport access vlan 68

  speed 1000



interface Ethernet1/9



interface Ethernet1/10



interface Ethernet1/11



interface Ethernet1/12



interface Ethernet1/13



interface Ethernet1/14



interface Ethernet1/15



interface Ethernet1/16



interface Ethernet1/17



interface Ethernet1/18



interface Ethernet1/19



interface Ethernet1/20



interface mgmt0

  vrf member management

  ip address 172.20.xx.1/24

clock timezone CST -6 0

line console

boot kickstart bootflash:/n5000-uk9-kickstart.4.1.3.N2.1.bin

boot system bootflash:/n5000-uk9.4.1.3.N2.1.bin

ip route 0.0.0.0/0 172.20.xx.250

Open in new window

0
Comment
Question by:rclaxton1
1 Comment
 

Accepted Solution

by:
rclaxton1 earned 0 total points
ID: 34125714
I again answered my own question. After looking at the logs in the NPS server I'm getting authentication errors and the nexus device is communicating w/ config above, However the error message "unable to communicate with AAA servers on the Nexus is just...false. Maybe this is fixed in a later code version in Nexus but put me in a four hour problem-solving detour. Please close this question. --Rob.
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

New Server 172.16.200.2  was moved from behind Router R2 f0/1 to behind router R1 int f/01 and has now address 172.16.100.2. But we want users still to be able to connected to it by old IP. How to do it ? We can used destination NAT (DNAT).  In DNAT…
Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now