External Radius Logins for AAA Network authentication "monitor only"

[Aaron_Becker]

Currently working on a NX5500 Controller and we cannot get the administrative logins (SSH, HTTPS) to work with Radius. We are able to log in as a Radius user, but are unable to edit anything. Below is the config from the CLI.

aaa-policy AAA-RADIUS-AUTH
authentication server 1 host 192.168.0.1 secret 0 12345

radius-group network-radius-authentication-group
policy access web ssh telnet console
policy role superuser

management-policy CONTROLLER-RADIUS
no telnet
no http server
https server
rest-server
no ftp
ssh
user admin password 1 b967e3847818d317f14c61785831183139a351123a98706f77fc983f6142879f role superuser access all
no snmp-server manager v3
aaa-login radius fallback
aaa-login radius policy AAA-RADIUS-AUTH

We've followed
https://extremeportal.force.com/ExtrArticleDetail?an=000081612

What are we missing?

[Aaron_Becker]

Thanks. I hadn't seen that documentation before. Much appreciated!

[Ronald_Dvorak · Accepted solution]

Page#8 ?!
https://documentation.extremenetworks.com/ExtremeWireless/RADIUS_ATTRIBUTES_HTG_EN.pdf

Document found here....
https://extremeportal.force.com/ExtrArticleDetail?an=000085409

[Aaron_Becker]

Yes, and as you can see in my above CLI posts, I configured that. I think I'm missing something between the Radius groups and the actual radius server. I don't think it's actually checking the radius server for the group permissions, since that isn't really how radius works in the first place. Is it perhaps using LDAP on the backend to find the user groups permissions?

[Ronald_Dvorak]

I'ver never configured it but could it be that the KB article includes the problem/answer....

"AAA login requires also RADIUS group | role to be assigned to an account, otherwise it will be using monitor privileges only.
If you want to set different level of access, you have to create specific RADIUS groups, i.e.:"