780 CHAPTER 53: AAA/RADIUS/HWTACACS CONFIGURATION
Check that:
1 The NAS and the RADIUS server can ping each other.
2 The username is in the userid@isp-name format and a default ISP domain is
specified on the NAS.
3 The user is configured on the RADIUS server.
4 The password entered by the user is correct.
5 The same shared key is configured on both the RADIUS server and the NAS.
Symptom2: RADIUS packets cannot reach the RADIUS server.
Analysis:
1 The communication link between the NAS and the RADIUS server is down (at the
physical layer and data link layer).
2 The NAS is not configured with the IP address of the RADIUS server.
3 The UDP ports for authentication/authorization and accounting are not correct.
Solution:
Check that:
1 The communication links between the NAS and the RADIUS server work well at
both physical and link layers.
2 The IP address of the RADIUS server is correctly configured on the NAS.
3 UDP ports for authentication/authorization/accounting configured on the NAS are
the same as those configured on the RADIUS server.
Symptom3: A user is authenticated and authorized, but accounting for the user is
not normal.
Analysis:
1 The accounting port number is not correct.
2 Configuration of the authentication/authorization server and the accounting
server are not correct on the NAS. For example, one server is configured on the
NAS to provide all the services of authentication/authorization and accounting,
but in fact the services are provided by different servers.
Solution:
Check that:
1 The accounting port number is correctly set.
2 The authentication/authorization server and the accounting server are correctly
configured on the NAS.
Troubleshooting
HWTACACS
Refer to “Troubleshooting RADIUS” on page 779 if you encounter a HWTACACS
fault.
To Next Page
Loading...
