Radius reachability problem on VOSS

[Jave]

Hi everybody,

Trying to set up a management radius connection on VOSS switch, all works fine but I'm unable to have a correct radius servers reachability.
Radius connection on CLI works well, but no dummy packets are sent to nac server (I can't see anything with tcpdump on server), so when it goes down, new connection lags because switch still try to authenticate towards server...
Any idea ?


(exemple here with web access)

Rodjeur

[Ludovico_Steven · Accepted solution]

Sorry, do not recall getting any email alert about this... Giuseppe sent me the link now.
So, RADIUS reachability feature is only relevant for EAPoL, in particular fail-open and continuity modes. Basically, the EAPoL function needs to know when/if the RADIUS servers change or all fail. Endpoint-tracking also uses RADIUS reachability.

For CLI RADIUS authentication, what's the use ? If a RADIUS server is available it will be used, else, if not RADIUS response, it will fallback to local password.

[Jave]

Hi Ludovico,

The use of Radius reachability for CLI access is to not waiting about 1 min before fallback to local password when radius servers are unreachable for any reason...

Regards.

[Miguel-Angel_RO]

Rodjeur,

This is working for me in production:
CORE-01:1#show radius-server
==================================================================================================================
Radius Server Entries
==================================================================================================================
ACCT ACCT SOURCE
NAME USEDBY SECRET PORT PRIO RETRY TIMEOUT ENABLED PORT ENABLED IP
------------------------------------------------------------------------------------------------------------------
10.10.10.56 cli ****** 1812 10 1 8 true 1813 true 10.11.10.254
10.10.10.58 cli ****** 1812 10 1 8 true 1813 true 10.11.10.254
10.10.10.56 eapol ****** 1812 10 1 8 true 1813 true 10.11.10.254
10.10.10.58 eapol ****** 1812 10 1 8 true 1813 true 10.11.10.254
10.10.10.56 web ****** 1812 10 1 8 true 1813 true 10.11.10.254
10.10.10.58 web ****** 1812 10 1 8 true 1813 true 10.11.10.254

CORE-01:1#show radius reachability
EAP RADIUS reachability mode : use-radius
EAP RADIUS reachability status : reachable
EAP RADIUS reachable server : 10.10.10.56
Time until next check : 37
RADIUS username : reachme
RADIUS password : reachme
RADIUS keep-alive-timer : 180
RADIUS unreachable-timer : 60

CORE-01:1#show run modu radius
config terminal
# RADIUS CONFIGURATION
radius server host 10.10.10.56 key ****** source-ip 10.11.10.254
radius server host 10.10.10.58 key ****** source-ip 10.11.10.254
radius server host 10.10.10.56 key ****** used-by eapol source-ip 10.11.10.254
radius server host 10.10.10.58 key ****** used-by eapol source-ip 10.11.10.254
radius server host 10.10.10.56 key ****** used-by web source-ip 10.11.10.254
radius server host 10.10.10.58 key ****** used-by web source-ip 10.11.10.254
radius enable
radius accounting enable
radius sourceip-flag
radius reachability username reachme passwordreachme
end

Regards,

Mig

[Jave]

Hello Miguel-Angel,

Thanks for your reply, but it seems that you're running on a VSP8600 Series, with specific command radius sourceip-flag, which doesn't exist on other models.
That's my current setup:

5520-24X-VOSS:1#sho run mod rad

config terminal

#
# RADIUS CONFIGURATION
#

radius server host 10.124.100.4 key ******  used-by web
radius enable
radius reachability keep-alive-timer 30 unreachable-timer 30

end​

The strange thing is that radius request are well managed with this config, and UDP traffic on port 1812 reaches correctly the server, but it's not the case for radius reachability...

Rodjeur