Cisco Prime and Radius

Question

I have setup Prime to use Radius, i can see authenication request to my radius but i keep getting user name and password is incorrect. I have 100's of switches authenticating to this radius server and everything works fine. I have loooked for logs in Prime for radius errors but I can't find anything.
any suggestions?                  

Answer 1

What's getting confused is the difference between AUTHENTICation (who are you?) and AUTHORIZation (what are you allowed to do?).  Clearly FreeRADIUS is saying that the AUTHENTICation passed--the credentials were correct--but it's not passing the correct AUTHORIZation information back.  Your IOS devices may bow to "shell:priv-lvl=15", but Prime Infrastructure isn't an IOS device, and has no idea what to do with that.  As well, the login failure mechanism isn't complicated enough yet to reflect to a user the difference between a failed AUTHENTICation or a failed AUTHORIZation.
There's a sample configuration document about NCS here in the Support Forum:
Freeradius for NCS config
All the correct AUTHORIZation attributes--the lines 'cisco-avpair += "NCS:task0=View Alerts and Events",'--from that sample are what you're missing.  The attributes are listed under Administration >  Users, Roles & AAA > User Groups > select a group > Task List hotlink for each group of user.  Remember that there HAS to be a VIRTUAL-DOMAIN attribute, a ROLE attribute and *ALL* of the TASK attributes associated with that group.  The attributes are going to be different from NCS to Prime Infrastructure, and tend to be different from version to version of each product, so you have to use the ones that are listed in whatever version of whatever product you're using right now.
Once you have FreeRADIUS configured to send the right attributes, to diagnose this full on, go to Administration > Logging, and set the logging level to Trace for the modules AAA, GUI and System, and click Save.  Then change your AAA settings and make a login attempt, allowing it to fail.  When it does, please return to Administration > Logging, and click the Download button to retrieve the logs.zip file.  Look in the ncs-0-0.log file and you'll see the transaction to FreeRADIUS, what Prime Infrastructure has to say to it, what FreeRADIUS says back, and what Prime Infrastructure does with the responses.