topic Re: How to configure radius authentication for EXOS switch management in ExtremeCloud A3

How to configure radius authentication for EXOS switch management

MLD — Wed, 05 Jan 2022 23:28:06 GMT

Hello,

I'm trying to configure A3 as our radius-mgmt server for switch authentication. I found an older article that mentions only Cicso Management Authentications are supported? The EXOS switch is a 440G2 running 31.3.1.3-patch1-10, with radius mgmt-access enabled and correct shared-secret. I enabled 'CLI Access' under the device settings as well. The RADIUS log show 'Auth Rejected' and I'm not sure what step/filter I might be missing.

Any guidance or step-by-step guides you can provide would be great.

Thanks,
Matt

Re: How to configure radius authentication for EXOS switch management

OscarK — Thu, 06 Jan 2022 13:57:25 GMT

Hi, this should be possible nowadays with A3.
In System Configuration/Admin Access add a new admin role, give it Switches Cli Read or Write.
In your authentication source add an admin access rule and set the access-level to the admin access role you defined.

Re: How to configure radius authentication for EXOS switch management

MLD — Thu, 06 Jan 2022 19:54:58 GMT

Forgot to mention that step as well, I created a new admin profile "Switch CLI" with both read and write switch cli access. That profile was added under my authentication source / administration rules / switch cli...

My auth source uses AD with ldap condition to match my account to the administration rule. I also added 'Connection Type' equals CLI-Access as a filter under my connection profile. The connection profile is set to Filters 'any'

Re: How to configure radius authentication for EXOS switch management

OscarK — Wed, 12 Jan 2022 15:57:53 GMT

I just got it working using local user accounts on A3.
See below article.
https://extremeportal.force.com/ExtrArticleDetail?an=000060486

Re: How to configure radius authentication for EXOS switch management

MLD — Thu, 13 Jan 2022 17:01:11 GMT

Thanks for the article. Is it possible to query an internal AD source for the user instead of creating the admin accounts locally?

Re: How to configure radius authentication for EXOS switch management

OscarK — Thu, 13 Jan 2022 17:16:50 GMT

One important thing, you need to configure port 1815 for mgmt-access instead of 1812. However in my tests it did not make a difference and I could only authenticate through local A3 users, however I am checking why ldap does not work.

Re: How to configure radius authentication for EXOS switch management

MLD — Wed, 19 Jan 2022 21:56:08 GMT

I upgraded to 4.0 today and re-tested with no luck. I also changed the radius mgmt-access port to 1815.

Do you think a connection profile needs to be setup as well? I noticed the NAS-Port-Type is Virtual and I have no connection profile setup for that type of connection. I do have a separate profile with the connection type set to CLI-Access using my internal AD/LDAP source

Re: How to configure radius authentication for EXOS switch management

OscarK — Thu, 20 Jan 2022 10:23:09 GMT

Hi, the connection profile that you hit should have the right auhtentication source added to it.

In my lab a bug was found in the extreme library handling snmp and we can change that file to fix it.
If you open a case with Extreme Networks and ask it to be assigned to me (Oscar Koot) we can check if the same fix helps for you.

Re: How to configure radius authentication for EXOS switch management

MLD — Thu, 20 Jan 2022 22:28:04 GMT

Thanks Oscar!
Can you send me your local user auth setup? I'd like to test that as well, maybe using A3 local user auth is the better option here.

Re: How to configure radius authentication for EXOS switch management

OscarK — Fri, 21 Jan 2022 10:26:41 GMT

Hi,

in the connection profile I have 1 profile that filters simply on device IP for test but in a real network you should match on the right connection type or maybe port.
In the sources of the profile add local.
Create a local user and set the actions to the correct access-level. Make sure the time/date are good. There were issue's where the user could only login the next day as the start time was set wrong.

Re: How to configure radius authentication for EXOS switch management

MLD — Wed, 26 Jan 2022 22:26:04 GMT

I was testing some other features with A3 so I just got back to this. Can you send me a screenshot of your setup?

Here's the RADIUS log entry for the test account I setup...

RADIUS Request

User-Name = "testuser" User-Password = "******" NAS-IP-Address = 10.10.200.1 NAS-Port = 0 Service-Type = Login-User Called-Station-Id = "00:04:96:9e:57:50" Calling-Station-Id = "10.24.156.103" NAS-Identifier = "lab_es01" Proxy-State = 0x3834 NAS-Port-Type = Virtual Event-Timestamp = "Jan 26 2022 14:25:16 EST" Message-Authenticator = 0xa44631837f24d451e2bc18af610cf90e Stripped-User-Name = "testuser" Realm = "null" FreeRADIUS-Client-IP-Address = 10.24.10.156 PacketFence-KeyBalanced = "8d43c43cef1ed029bd9bb5b119c2518d" PacketFence-Radius-Ip = "10.24.10.155" PacketFence-Src-Ip = "10.10.200.1" SQL-User-Name = "testuser"

RADIUS Reply

Reply-Message = "Mac is empty" Proxy-State = 0x3834

Re: How to configure radius authentication for EXOS switch management

OscarK — Thu, 27 Jan 2022 10:46:58 GMT

Connection Profile
Authentication source
Auth source rule