ACS 4.2 doesn't response RADIUS access-request

I have configured radius 4,2:
- Create an internal database, a account
- Create an AAA client, with pass the same on Authenticator server
- Authenticate using Radius-Aironet (and try with other radius vendor)
- Submit and Apply
From Authenticator ( Ruckus Zone-director 1000)
- Configure the same secret pass with ACS
- IP: ACS, Port: 1812
- Send user name and pass which created on ACS server
From authenticator, send raidius access-request with username & pass have created on ACS, but ACS doesn't response any message even fail ..
Could you please help me figure out the happening problem
Thank a lot
-Brian.

Brian,
I would also like you to check following,
Please go to Network Configuration > If we have Network Device Group option enabled, then go the network device group---Edit properties---remove the shared secret from there---submit the changes.
And try again, If authentication works, that would mean that we have configured a Network Device Group level key. And a NDG level key over rides the AAA
Client level key.
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/user/NetCfg.html#wp342699
Are we seeing "unknown NAS" with the same NAS ip address the one we have added on the ACS under network configuration?
Regds,
JK
Do rate helpful posts-

Similar Messages

Missing AVP 29 VSA 23 in the Radius Access-Request sent by ASA 5545-X 8.6

Hello,
we are migrating from ASA 5520 Version 8.4(3) to ASA 5545-X Version 8.6(1)2 with the same configuration ;
we are stuck with a Radius authentication problem related to an ASA clientless ASA access ;
when we compare the Radius dialog between each ASA (the old one and the new one) and the same Radius ACS 5.3 server, we can see that the only difference is there is a missing AVP 29 VSA 23 in the Radius Access-Request sent by the new ASA-5545-X compared to the good one sent by the old ASA 5520;
this AVP 29 VSA 23 carries the tunnel-group name as defined in the ASA configurtion ;
5545-X ad 5520 configuration files have been double-checked and compared : no difference between both files
any help would be appreciated to diagnose this problem
thanks in advance

This problem was solved by upgrading the 5545-X from version 8.6(1)2 to version 9.1.2;
nothing else changed

Framed-IP-Address in RADIUS Access Request for WLC web-auth users

We have a web-auth WLAN (with 7.6.130.0 software on a 2504 WLC) configured to authenticate users through RADIUS. The Framed-IP-Address attribute, representing the client device's IP address is sent in the Accounting Request, as expected. However, this information should be available at the WLC before sending the RADIUS Access Request, since the device is already having an IP address.
So is there a way to configure the WLC to send the Framed-IP-Address attribute in the RADIUS Access Request as well?

Hi ,
Try using:
aaa accounting delay-start
Regards,
~JG
Do rate helpful posts

ACS-4.1 - doesn't display Radius(Nortel) in Interface configuration

We have one ACS running over Windows that we can see the Radius(Nortel) option in Interface Configuration.
Have anyone treated with this issue?

That is probably because you have no AAA device configured for Radius (Nortel). IF you configure one, it will appear in the interface configuration
Nicolas
===
Don't forget to rate answers that you find useful

ISE Radius - Access-accept is returned with no autorization policy

Hello,
With ISE Radius service / PAP, the authentication passes OK, but the Network Element which send the autorization request, returns message "not enough user priviledges to execute command" and the HTTP page is blank.
The reason for that is, the Network Element is sending in the Access-Request with Service-Type value = 8, which means Authenticate-Only (and this can be seen at ISE . This causes the Radius server to authenticate, but not to send the authorization parameters back to the NE in the Access-Accept, causing the login to fail. A bit inside of the RFC:
5.6. Service-Type
    Description
       This Attribute indicates the type of service the user has
      requested, or the type of service to be provided. It MAY be used
      in both Access-Request and Access-Accept packets. A NAS is not
      required to implement all of these service types, and MUST treat
      unknown or unsupported Service-Types as though an Access-Reject
      had been received instead.
   Type
       6 for Service-Type.
      The Value field is four octets.
       1      Login
       2      Framed
       3      Callback Login
       4      Callback Framed
       5      Outbound
       6      Administrative
       7      NAS Prompt
       8      Authenticate Only
       9      Callback NAS Prompt
      10      Call Check
      11      Callback Administrative
There is no way to modify the value on the network element in the Access-Request packet.
Question: Is there a way to for the Cisco ISE to ignore the service type value (Authenticate Only), and return the autorization parametes back with the Access-Accept packet?
Thanks,
Lucho

Lucho,
I Checked the rfc and the answer is no, rfc states that no authorzation information needs to returned for this request.
http://www.ietf.org/rfc/rfc2865.txt
Thanks,
Tarik

IChart Pie Chart doesn't response to SelectionEvent

Hi,
I have a pie chart. I would like to have the slices in the pie chart clickable. When one slice is selected, I would like to display the detail information in another iGrid table. I have done it with iChart Bar with no problem. However, it seems like the pie chart doesn't response to any selection on the slices, except the legend tags for the whole chart.
Did I miss some configuration?
Thank you for your advice!

Hi Yue,
Instead of trying to click on the Chart, try clicking on the legend. It will work. It is working for me here.
Use the same Selection Event and same Javascript. And click on the <b>Legend</b>. It will display the desired Value.
For Example, i have used the below code for my SelectionEvent.
<b>document.ChartName.getChartObject().getSelectedPen();</b>
Hope this will help u.
Regards
Muzammil

TCL and Radius, not getting a ACCESS-REQUEST /ACCEPT / REJECT

I'm trying to setup TCL for PREPAID. I'm told by the person who's making the script that no ACCESS-REQUEST is going through to the RADIUS SERVER (FREE RADIUS).
Anyone have any ideas?? Here's a debug output...
Feb 25 21:36:36.798: RADIUS(0000229C): Config NAS IP: 0.0.0.0
Feb 25 21:36:36.798: RADIUS(0000229C): sending
Feb 25 21:36:36.802: RADIUS/ENCODE: Best Local IP-Address 66.38.123.145 for Radius-Server 66.38.193.149
Feb 25 21:36:36.802: RADIUS(0000229C): Send Accounting-Request to 66.38.193.149:1646 id 21829/176, len 213
Feb 25 21:36:36.802: RADIUS: authenticator B5 29 CF 05 BE 7E 9C F8 - FE 15 76 F2 9F 32 3D 55
Feb 25 21:36:36.802: RADIUS: Acct-Session-Id [44] 139 "14714/16:36:36.794 EST Fri Feb 25 2005/Router./1E30B8A1 86AC11D9 81649A83 4E410D97/originate/VoIP/////1E30B8A1 86AC11D9 81649A83 4E410D97"
Feb 25 21:36:36.806: RADIUS: User-Name [1] 12 "1111111111"
Feb 25 21:36:36.806: RADIUS: Acct-Status-Type [40] 6 Start [1]
Feb 25 21:36:36.806: RADIUS: Calling-Station-Id [31] 12 "4169237347"
Feb 25 21:36:36.806: RADIUS: Called-Station-Id [30] 6 "1111"
Feb 25 21:36:36.806: RADIUS: Service-Type [6] 6 Login [1]
Feb 25 21:36:36.806: RADIUS: NAS-IP-Address [4] 6 66.38.123.145
Feb 25 21:36:36.806: RADIUS: Acct-Delay-Time [41] 6 0
Feb 25 21:36:36.834: RADIUS(0000229C): Config NAS IP: 0.0.0.0
Feb 25 21:36:36.834: RADIUS(0000229C): sending
Feb 25 21:36:36.834: RADIUS/ENCODE: Best Local IP-Address 66.38.123.145 for Radius-Server 66.38.193.149
Feb 25 21:36:36.834: RADIUS(0000229C): Send Accounting-Request to 66.38.193.149:1646 id 21829/177, len 322
Feb 25 21:36:36.838: RADIUS: authenticator 11 18 AA 5F 2A 1D C6 5D - FD D5 85 A7 77 D3 08 CB
Feb 25 21:36:36.838: RADIUS: Acct-Session-Id [44] 218 "14714/16:36:36.786 EST Fri Feb 25 2005/Router./1E30B8A1 86AC11D9 81649A83 4E410D97/originate/VoIP/16:36:36.830 EST Fri Feb 25 2005/16:36:36.830 EST Fri Feb 25 2005/1C/66.38.193.148/1E30B8A1 86AC11D9 81649A83
thanks,
Paul

Maybe you miss some radius commands:
aaa authentication login h323 group radius
aaa authorization exec h323 group radius
best regards
Grzegorz

I have macbook pro 13.3 inch. I am installing window 7 in boot camp manager after copying file of window upto 67% it doesn't response and i had forcely shotdown my macbook. Now my macbook doesn't open and stop in black screen with cursor blinking.

i have macbook pro 13.3 inch. I am installing window 7 in boot camp manager after copying file of window upto 67% it doesn't response and i had forcely shotdown my macbook. Now my macbook doesn't open and stop in black screen with cursor blinking. Now how could i open my macbook pro.

At startup hold down the Option/Alt key and from the screen that comes up select your OS X partition to start the computer from. Then use the Boot Camp Assistant app to Remove Windows and the partition you reated for it and it will Automatically place the space you allocated for the Windows install back into the OS X partition.
NOTE:
Do NOT use Disk Utility to erase the partition that was created for the Windows install. Use the Boot Camp Assistant app again to do that.

Configuring AAA network client on ACS v5.1 using the same RADIUS atributes from ACS v3.3

Hello,
I was wondering if i should use the same RADIUS VSA attribute on ACS v5.1 to authenticate AAA clients as those i was using on my old ACS v3.3 server.
Exemple : under ACS v3.3 i was using RADIUS (Cisco Aironet) attribute to authenticate AP & WLC, should i do the same under ACS v5.1 ?
Best regards.

Hello,
When defining AAA client on the new ACS 5.x server you just select TACACS+ or RADIUS. We no longer define the RADIUS "vendor"/"VSA" when creating the AAA Client entry. All AAA client would be defined as RADIUS or TACACS+ only.
If you were using specific VSA Attributes then you need to send those attributes back configuring Authorization Profiles on the ACS 5.x. You will find the specific VSA attributes there. Refer to the following screenshots:
And here are the available attributes for the ACS for RADIUS Aironet:

Sometimes my iphone 4 menu button doesn't response immediately - any help?

sometimes my iphone 4 menu button doesn't response immediately - did any one experience this? is there any problem with my phone? i still have 16.7 G avail on y 32 G memory. thanks

Help here... Troubleshooting iPhone hardware
see: Buttons & Swtiches

Waiting for response has timed out and Bad response: 401 Access denied

Hi,
I am using a partner link to invoke a wsdl.This wsdl I am downloading from server after giving the username and password details.
So while invoking it i m providing the credentials details in bpel.xml file .
<property name="httpBasicHeaders">
<property name="httpBasicUsername">
<property name="httpBasicPassword">
After providing this details also I am getting error .
<faultstring>com.oracle.bpel.client.delivery.ReceiveTimeOutException: Waiting for response has timed out. The conversation id is 11d1def534ea1be0:-3d858514:1209f42a251:-7da8. Please check the process instance for detail.</faultstring>
</Fault>
On cheking to audit instance i m getting the below error:
exception on JaxRpc invoke: HTTP transport error: javax.xml.soap.SOAPException: java.security.PrivilegedActionException: javax.xml.soap.SOAPException: Bad response: 401 Access denied
Plz help me out asap.
Thnaks

can you please post you bpel.xml file the setting for basic authentication should be as follows. It is unclear if this is how you have it or you posted a subset of the bpel.xml.
<property name="httpBasicHeaders">credentials</property>
<property name="httpBasicUsername">your_username</property>
<property name="httpBasicPassword">your_password</property>
looking at the error it looks like you have given the wrong credentials.
cheers
James

My ipad2 cannot add events to calendars? There isn't a symbol "plus", and it doesn't response no matter how to tip it.

My ipad2 cannot add events to calendars? There isn't a symbol "plus", and it doesn't response no matter how to tip it.

This may sound a little stupid, have you tried turning on iCloud and test your calendar again.

I can't turn on my macbook pro it doesn't response to the power button..

a few hours ago i tried to turn it on but it only showed the apple screen for a few seconds and turn off automatically.. i can't turn it back on anymore..
it doesn't response to the power button nothing happen after pressing the button
I am sure it is charged... what should i do..?

Go step by step and test.
http://support.apple.com/kb/TS1365
Note: Steps 5 and 6
Step 5
Reset SMC. http://support.apple.com/kb/HT3964
Choose the method for:
"Resetting SMC on portables with a battery you should not remove on your own".
Best.

No Radius-accept-request received on Radius server

Hi,
I'm trying to access my network through 802.1X Radius authentication. My PC is connected to a 2950 switch with following configuration:
aaa new-model
aaa authentication dot1x default group radius
dot1x system-auth-control
radius-server host 11.0.0.2 key Ralf
on interface level(connection to PC):
switchport mode access
switchport access vlan 8
dot1x port-control auto
on interface level(connection to Radius server):
switchport mode access
switchport access vlan 8
I enabled 802.1X authentication on my PC via the service 'Wired Autoconfig' and in the tab authentication (one of the tabs of the interface configuration)
I choose PEAP.
Result:
When I trace my PC-interface with Wireshark, I see an EAPOL- EAP-Request and a EAP-Response message. The next message in the flow should be a Radius-Accept-request message but it seems that this message is never sent. Although, when i open a 'debug radius' session on the switch, the logs are indicating that the accept-request message is sent. Strange because I see no message coming in on the Radius-server interface.
The Radius-server has IP-address 11.0.0.2 and my PC 11.0.0.3.
Does anybody see a reason why the Radius-Accept-Request message is not received on my Radius-server interface?
Kind regards,Ralf.

Hi,
When using PEAP, the authnetication is not as simple as that.
This is the PEAP authentication process:
Here you can see the switch as the AP.
So, after the first EAP-Response message, the ACS must reply with an Access-Challenge containing the EAP-TLS start, so the encryption tunnel can be started.
One possible reason for this not to happen is simply because the ACS does not support PEAP and/or does not conatin the server certificate needed to build the TLS tunnel.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

After ISE 1.2 upgrade I get "5413 RADIUS Accounting-Request dropped."

Hello,
I have a two admin node setup for ISE. I just upgraded one of my two ISE Admin nodes to Version 1.2. I still have one of my admin nodes at 1.1.4. When I disable my Version 1.1.4 node and allow wireless authentications to be handled by the Version 1.2 node I get the message..."5413 RADIUS Accounting-Request dropped". None of my wireless edge devices will be allowed on the network during this time. When I re-enable my 1.1.4 node my wireless devices are then allowed on the network.
I am currently using ISE to authenticate wireless connectivity.
I also get the failure reason... "11038 RADIUS Accounting-Request header contains invalid Authentication field".
Any ideas?
Bob

The 5413 RADIUS Accounting-Request dropped may be because the session was active on ISE1 and is now sending update messages to ISE2. Also, verify your shared secret radius key matches on both the wlc and ISE servers. I would try clearing the WLC connection for the test user when switching. Just turning off wireless and back on doesn't do it. Also, are you using PEAP-MSChapv2 or EAP-TLS for authenticating the clients. What type of certificate is presented, public or private?

ACS 4.2 doesn't response RADIUS access-request

Similar Messages

Maybe you are looking for