安全与 VPN : 远程验证拨入用户服务 (RADIUS)

IOS每VRF RADIUS排除故障

2015 年 8 月 28 日 - 机器翻译
其他版本: PDFpdf | 英语 (2015 年 4 月 23 日) | 反馈


目录


简介

RADIUS大量地用于作为认证协议验证网络访问的用户。使用VPN路由与转发(VRF),更多admins分离他们的管理数据流。默认情况下,在IOS �的验证、授权和统计(AAA)使用默认路由路线表为了发送数据包。当RADIUS服务器在VRF时,此指南描述如何配置和排除故障RADIUS。

注意: 贡献用杰西杜波伊斯, Cisco TAC工程师。

先决条件

要求

Cisco 建议您了解以下主题:

  • RADIUS

  • VRF

  • AAA

使用的组件

本文档不限于特定的软件和硬件版本。

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始(默认)配置。如果您使用的是真实网络,请确保您已经了解所有命令的潜在影响。

规则

有关文档规则的详细信息,请参阅 Cisco 技术提示规则

功能信息

本质上, VRF是在设备的虚拟路由路线表。当IOS做出路由决策时,如果功能或接口使用VRF,路由决策做该VRF路由表。否则,功能使用全球路由表。鉴于此,这是您如何配置RADIUS使用VRF :

version 15.2
service config
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname vrfAAA
!
boot-start-marker
boot-end-marker
!
aaa new-model
!
aaa group server radius management
 server-private 192.0.2.4 key cisco
 server-private 192.0.2.5 key cisco
 ip vrf forwarding blue
 ip radius source-interface GigabitEthernet0/0
!
aaa authentication login default group management local
aaa authorization exec default group management if-authenticated 
aaa accounting exec default start-stop group management
!
aaa session-id common
!
no ipv6 cef
!
ip vrf blue
!
no ip domain lookup
ip cef
!
interface GigabitEthernet0/0
 ip vrf forwarding blue
 ip address 203.0.113.2 255.255.255.0
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route vrf blue 0.0.0.0 0.0.0.0 203.0.113.1
!
line con 0
line aux 0
line vty 0 4
 transport input all

正如你看到的没有全局定义RADIUS服务器。如果移植服务器到VRF,您能安全删除全局配置的RADIUS服务器。

故障排除方法

完成这些步骤:

  1. 确保您有适当的IPVRF转发定义在您的AAA组服务器下以及RADIUS流量的源接口。

  2. 检查您的VRF路由表并且确保那里是路由到您的RADIUS服务器。我们将使用以上示例为了显示VRF路由表:

    vrfAAA#show ip route vrf blue
    
    Routing Table: blue
    Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
           D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           I - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
           ia - IS-IS inter area, * - candidate default, U - per-user static route
           o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
           + - replicated route, % - next hop override
    
    Gateway of last resort is 203.0.113.1 to network 0.0.0.0
    
    S*    0.0.0.0/0 [1/0] via 203.0.113.1
          203.0.113.0/8 is variably subnetted, 2 subnets, 2 masks
    C        203.0.113.0/24 is directly connected, GigabitEthernet0/0
    L        203.0.113.2/32 is directly connected, GigabitEthernet0/0
    
  3. 能ping您的RADIUS服务器?收回这需要是VRF特定:

    vrfAAA#ping vrf blue 192.0.2.4
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.0.2.4, timeout is 2 seconds:
    !!!!!
    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
    
  4. 您能使用aaa命令的测验为了验证连接(您必须使用新代码选项在末端;传统不工作) :

    vrfAAA#test aaa group management cisco Cisco123 new-code
    User successfully authenticated
    
    USER ATTRIBUTES
    
    username             "cisco"

如果路由到位,并且没看到在您的RADIUS服务器的命中数,请确保ACL允许udp端口1645/1646或udp端口1812/1813到达从路由器或交换机的服务器。如果获得认证失败,请排除故障RADIUS作为正常。VRF功能是为数据包的路由。

数据分析

如果一切看起来正确, aaaradius调试指令可以启用为了排除故障问题。用这些调试指令开始:

  • debug radius

  • debug aaa authentication

这是某事没有适当地配置调试的示例,例如,但是没限制对:

  • 缺少RADIUS源接口

  • 转发命令的缺少IP VRF在源接口下或在AAA组服务器下

  • 对RADIUS服务器的没有路由在VRF路由表里

    Aug  1 13:39:28.571: AAA/AUTHEN/LOGIN (00000000): Pick method list 'default' 
    Aug  1 13:39:28.571: RADIUS/ENCODE(00000000):Orig. component type = Invalid
    Aug  1 13:39:28.571: RADIUS/ENCODE(00000000): dropping service type, 
       "radius-server attribute 6 on-for-login-auth" is off
    Aug  1 13:39:28.571: RADIUS(00000000): Config NAS IP: 203.0.113.2
    Aug  1 13:39:28.571: RADIUS(00000000): Config NAS IPv6: ::
    Aug  1 13:39:28.571: RADIUS(00000000): sending
    Aug  1 13:39:28.575: RADIUS(00000000): Send Access-Request to 192.0.2.4:1645
       id 1645/2, len 51
    Aug  1 13:39:28.575: RADIUS:  authenticator 12 C8 65 2A C5 48 B8 1F - 
       33 FA 38 59 9C 5F D3 3A
    Aug  1 13:39:28.575: RADIUS:  User-Password       [2]   18  *
    Aug  1 13:39:28.575: RADIUS:  User-Name           [1]   7   "cisco"
    Aug  1 13:39:28.575: RADIUS:  NAS-IP-Address      [4]   6   203.0.113.2              
    Aug  1 13:39:28.575: RADIUS(00000000): Sending a IPv4 Radius Packet
    Aug  1 13:39:28.575: RADIUS(00000000): Started 5 sec timeout
    Aug  1 13:39:32.959: RADIUS(00000000): Request timed out 
    Aug  1 13:39:32.959: RADIUS: Retransmit to (192.0.2.4:1645,1646) for id 1645/2
    Aug  1 13:39:32.959: RADIUS(00000000): Started 5 sec timeout
    Aug  1 13:39:37.823: RADIUS(00000000): Request timed out 
    Aug  1 13:39:37.823: RADIUS: Retransmit to (192.0.2.4:1645,1646) for id 1645/2
    Aug  1 13:39:37.823: RADIUS(00000000): Started 5 sec timeout
    Aug  1 13:39:42.199: RADIUS(00000000): Request timed out 
    Aug  1 13:39:42.199: RADIUS: Retransmit to (192.0.2.4:1645,1646) for id 1645/2
    Aug  1 13:39:42.199: RADIUS(00000000): Started 5 sec timeout
    Aug  1 13:39:47.127: RADIUS(00000000): Request timed out 
    Aug  1 13:39:47.127: RADIUS: Fail-over to (192.0.2.5:1645,1646) for id 1645/2
    Aug  1 13:39:47.127: RADIUS(00000000): Started 5 sec timeout
    Aug  1 13:39:51.927: RADIUS(00000000): Request timed out 
    Aug  1 13:39:51.927: RADIUS: Retransmit to (192.0.2.5:1645,1646) for id 1645/2
    Aug  1 13:39:51.927: RADIUS(00000000): Started 5 sec timeout
    Aug  1 13:39:56.663: RADIUS(00000000): Request timed out 
    Aug  1 13:39:56.663: RADIUS: Retransmit to (192.0.2.5:1645,1646) for id 1645/2
    Aug  1 13:39:56.663: RADIUS(00000000): Started 5 sec timeout
    Aug  1 13:40:01.527: RADIUS(00000000): Request timed out 
    Aug  1 13:40:01.527: RADIUS: Retransmit to (192.0.2.5:1645,1646) for id 1645/2
    Aug  1 13:40:01.527: RADIUS(00000000): Started 5 sec timeoutUser rejected

不幸地,与RADIUS没有超时和一个缺少路由之间的差异。

这是成功认证的示例:

Aug  1 13:35:51.791: AAA/AUTHEN/LOGIN (00000000): Pick method list 'default' 

Aug  1 13:35:51.791: RADIUS/ENCODE(00000000):Orig. component type = Invalid

Aug  1 13:35:51.791: RADIUS/ENCODE(00000000): dropping service type, 
   "radius-server attribute 6 on-for-login-auth" is off

Aug  1 13:35:51.791: RADIUS(00000000): Config NAS IP: 203.0.113.2

Aug  1 13:35:51.791: RADIUS(00000000): Config NAS IPv6: ::

Aug  1 13:35:51.791: RADIUS(00000000): sending

Aug  1 13:35:51.791: RADIUS(00000000): Send Access-Request to 192.0.2.4:1645 id 
   1645/1, len 51

Aug  1 13:35:51.791: RADIUS:  authenticator F4 E3 00 93 3F B7 79 A9 - 
   2B DC 89 18 8D B9 FF 16

Aug  1 13:35:51.791: RADIUS:  User-Password       [2]   18  *

Aug  1 13:35:51.791: RADIUS:  User-Name           [1]   7   "cisco"

Aug  1 13:35:51.791: RADIUS:  NAS-IP-Address      [4]   6   203.0.113.2              

Aug  1 13:35:51.791: RADIUS(00000000): Sending a IPv4 Radius Packet

Aug  1 13:35:51.791: RADIUS(00000000): Started 5 sec timeout

Aug  1 13:35:51.799: RADIUS: Received from id 1645/1 14.36.142.31:1645, 
   Access-Accept, len 62

Aug  1 13:35:51.799: RADIUS:  authenticator B0 0B AA FF B1 27 17 BD - 
   3F AD 22 30 C6 03 5C 2D

Aug  1 13:35:51.799: RADIUS:  User-Name           [1]   7   "cisco"

Aug  1 13:35:51.799: RADIUS:  Class               [25]  35  

Aug  1 13:35:51.799: RADIUS:   43 41 43 53 3A 6A 65 64 75 62 6F 69 73 2D 61 63 
   [CACS:ACS1]

Aug  1 13:35:51.799: RADIUS:   73 2D 35 33 2F 31 33 32 34 35 33 37 33 35 2F 33 
   [s-53/132453735/3]

Aug  1 13:35:51.799: RADIUS:   38                 [ 8]

Aug  1 13:35:51.799: RADIUS(00000000): Received from id 1645/1.

常见问题

  • 最常见的问题是那配置。许多时间admin在aaa组服务器将放置,但是不会更新aaa线路指向服务器组。而不是此:

    aaa authentication login default group management local
    aaa authorization exec default group management if-authenticated 
    aaa accounting exec default start-stop group management

    admin在这中放置:

    aaa authentication login default grout radius local
    aaa authorization exec default group radius if-authenticated 
    aaa accounting exec default start-stop group radius

    请更新与正确服务器组的配置。

  • 第二常见问题是用户将看到此错误,当尝试转发在服务器组下时的添加IP VRF :

    % Unknown command or computer name, or unable to find computer address

    这意味着未找到命令。如果看到此错误,请确保IOS版本支持每个VRF RADIUS。

相关的思科支持社区讨论

思科支持社区是您提问、解答问题、分享建议以及与工作伙伴协作的论坛。


相关信息


Document ID: 113666