Dear colleagues,
currently I sit in front of an EX 4200 switch with JunOS 10.0R2 and try to implement per-user RADIUS authentication. I adapted the config from the code example Juniper provides at
http://www.juniper.net/techpubs/en_US/junos10.0/information-products/topic-collections/subscriber-access/aaa-subscriber-access-radius-authentication-accounting.html and
http://www.juniper.net/techpubs/en_US/junos9.6/topics/task/configuration/radius-server-ex-series-cli.html.
This is my config at the moment (only the necessary parts):
access {
radius-server {
192.168.2.1 {
secret "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; ## SECRET-DATA
timeout 3;
retry 1;
source-address 192.168.3.15; (this is the outgoing interface IP)
}
192.168.1.1 {
secret "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; ## SECRET-DATA
timeout 3;
retry 1;
source-address 192.168.3.15; (this is the outgoing interface IP)
}
}
profile profile1 {
authentication-order radius;
radius {
authentication-server [ 192.168.2.1 192.168.1.1 ];
accounting-server [ 192.168.2.1 192.168.1.1 ];
}
accounting {
order radius;
accounting-stop-on-failure;
accounting-stop-on-access-deny;
immediate-update;
statistics time;
}
}
}
With this code, the EX does not try to contact the RADIUS server (of course, the server itself is reachable). In the RADIUS log messages there is no entry for an authentication try.
The Syslog shows the following output (first try SSH, second try telnet):
"Dec 13 07:52:39 sshd[1405]: Failed password for test from 192.168.3.1 port 4796 ssh2
Dec 13 07:52:43 inetd[709]: /usr/sbin/sshd[1405]: exited, status 255
Dec 13 07:53:03 login: LOGIN_PAM_AUTHENTICATION_ERROR: PAM authentication error for user test
Dec 13 07:53:03 login: LOGIN_FAILED: Login failed for user test from host 192.168.3.1"
In the JunOS Cookbook, I found an instruction to implement the following code:
system {
radius-server {
192.168.2.1 {
port 1645;
accounting-port 1646;
secret "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; ## SECRET-DATA
timeout 3;
retry 1;
}
192.168.1.1 {
port 1645;
accounting-port 1646;
secret "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; ## SECRET-DATA
timeout 3;
retry 1;
}
}
This doesn't help anyway, I can only log in with the locally configured username.
Did I forget anything? I hope someone has an idea.
Thank you!
