Contents

Introduction

Prerequisites

Configuration on Windows server

1. Install Active Directory Domain Services

2.Create the Active Directory user (the login account)

3.Create an AD security group for UCS admins

4. Install the NPS (RADIUS role) andRegister NPS in Active Directory

5.Add the UCS Fabric Interconnects as RADIUS Clients

6.Create a Connection Request Policyand Network Policy (the authorization + role mapping)

Configuration on UCSM

1. Create a Radius Provider and add to a Provider Group

2. Create an Authentication Domain

Verify

From Windows Server - Confirm Firewall / Ports

Test Login From UCSM

Troubleshoot Radius Authentication

From Windows Server

From UCSM CLI

Related Information

Introduction

This document describes the steps to Configure and Troubleshoot Radius on UCS Manager using a Windows Server 2022 DataCenter.

Prerequisites

- UCS Manager - 4.2(3o) or higher

- Windows Server 2022 DataCenter

Configuration on Windows server

1. Install Active Directory Domain Services

Refer Microsoft document - Install AD DS using Server Manager on Windows Server 2022.

2. Create the Active Directory user (the login account)

- Open Server Manager → Tools → Active Directory Users and Computers.

- Right-click your created domain → New → User.

- Enter the login name (Example - testuser), set a password, uncheck "User must change password at next logon", and check "Password never expires" (for a service/admin account) >> Finish. (*subject to your local security requirements/policies)

3. Create an AD security group for UCS admins

- In the same console, right-click your domain → New → Group (Example - testRadius, Security) >> Add the AD user "testuser") to this group.

- This group name is what you have to later map to a UCS role.

4. Install the NPS (RADIUS role) and Register NPS in Active Directory

- Server Manager → Manage → Add Roles and Features.

- Select Network Policy and Access Services >> Complete the wizard to install Network Policy Server (NPS).

- Open Tools → Network Policy Server. Right-click NPS (Local) → Register server in Active Directory → OK. This lets NPS read AD user/group membership.

5. Add the UCS Fabric Interconnects as RADIUS Clients

- This tells NPS to trust requests from UCSM. In NPS, expand RADIUS Clients and Servers → RADIUS Clients → right-click → New.

- Provide :

- Friendly name: Example - UCSM

- Address (IP): the management IP of FI-A

- Shared Secret: create a strong secret and write it down — you are to enter this exact shared secret string in UCSM later.

- Repeat for Fabric Interconnect B and, if you are to authenticate against the cluster VIP, add that IP too.

- Radius Clients

6. Create a Connection Request Policy and Network Policy (the authorization + role mapping)

- Policies → Connection Request Policies → New >> Name it (Example - UCS-radiustest), add the condition for 'Client Friendly Name' which allows it to authenticate locally. For example : FI-* or UCSM,

- Policies → Network Policies → New >> Policy name

- Conditions: add Windows Groups → select the testRadius group you made in Step 3

- Access permission: Grant access

- Authentication Methods: enable Unencrypted authentication (PAP/SPAP) and/or the methods UCS uses. (UCS RADIUS commonly uses PAP.)

- Configure Settings → Vendor Specific Attributes (this is the key part that maps the AD user to a UCS role) : Add a Vendor-Specific attribute → Cisco AV-Pair

- Set the value to the UCS role/locale string, Example - shell:roles="admin" (If you skip this attribute, the user logs in as read-only)

Connection Request Policy :

Network Policy :

Vendor Specific Attribute :

Configuration on UCSM

1. Create a Radius Provider and add to a Provider Group

- Log in to UCS Manager GUI and navigate to Admin → User Management → RADIUS.

- Click Create RADIUS Provider (the "+" / Create option) and fill in:

- Hostname/FQDN or IP: your Windows NPS server.

- Key: the exact Shared Secret you set in NPS Step 5.

- Authorization Port: 1812 (must match NPS)

- Timeout / Retries: leave defaults to start.

- Under Admin → User Management → RADIUS, create a Provider Group (Example - RADIUS-Grp) and add the provider from earlier.

2. Create an Authentication Domain

- This is the piece that ties it all together.

- Navigate to Admin → User Management → Authentication → Authentication Domains.

- Click Create a Domain (Example - RADIUS - domain name recommended to be the same as the domain created in NPS).

- Set Realm = RADIUS.

- Assign the Provider Group you created (RADIUS-Grp) and Save.

Verify

From Windows Server - Confirm Firewall / Ports

- RADIUS authentication uses UDP port 1812 (and accounting 1813). Ensure the Windows firewall and any network firewall allow these from the FI mgmt IPs.

- Confirm NPS / Radius service is listening through command prompt >> "netstat -ano | findstr 1812. "

- (You are to see a line with UDP and *:1812 (or the server IP:1812). This confirms the NPS/RADIUS service is actively listening.

- If nothing shows, NPS could not be running — check Services → "Network Policy Server" (IAS) is Started.)

- On Windows Powershell, run the command :

- Get-NetFirewallRule -DisplayGroup "Network Policy Server" | Format-Table DisplayName, Enabled, Direction, Action.

- On Windows Event Viewer :

- Custom Views >> Server Roles >> Network Policy and Access Services - Packets are reaching.

Test Login From UCSM

- Log out and Login by choosing "Domain" dropdown as per the created Radius domain.

- Configure user password. (Refer - Windows configuration Step 2).

- If the login works and you land with admin privileges, the Cisco AV-Pair mapping (Windows configuration Step 6) is correct.

Troubleshoot Radius Authentication

From Windows Server

- Execute these commands in Powershell for packet capture -

- pktmon filter add -p 1812

- pktmon start --capture --pkt-size 0 -f C:\radius_capture.etl

- Initiate login from UCSM and stop capture using commands :

- pktmon stop

- pktmon etl2pcap C:\radius_capture.etl -o C:\radius_capture.pcap

- Open radius_capture.pcap in Wireshark : RADIUS >> Attribute Value Pairs >> confirm Message-Authenticator (or attribute 80) is present >> implies NPS is signing the reply.

From UCSM CLI

- When running pktmon on Windows, simultaneously from UCSM CLI, run

- connect nxos

- terminal monitor

- debug radius all

- Attempt a UCSM login after initiating debug.

- A successful login looks similar to "2026 Jul 3 09:54:02.917044 radius:Verified Message Authenticator in response from: 10.xxx.xx.xx."

- If packets are sent and received but login is failing with "message authenticator is probably incorrect." in the debug output - this implies the port and reachability are fine.

- Try reconfiguring the shared secret in Windows NPS server and the UCSM key once again (these need to be exactly matched).

- If issue persists while logging in post reconfiguring, we could be hitting a known Cisco bug ID CSCwm80801 : User cannot login to UCSM using Radius after Microsoft patch KB5040434 requiring an upgrade to a mentioned fixed release.

Related Information

Cisco UCS Manager Administration Management Guide 4.2 - Remote Authentication