Network Management

Hi, on the first of these questions, this is by design and desired by most. If the switch has a route to the IP of the radius server it will use that method solely. It falls to the next method in the line (local in your case) when it can't get to the radius server. 

This is good because you don't allow an insecure method permanently. This is one that can be brute forced. It allows the actual admin to be recorded against actions and not anyone who knows the local password. 

The behaviour changes depending on OS. For old procurve the switch tries to get a radius response about 7 times, then allows local credentials. If health checking radius server is available (like CX) then a failed health check drops you to the next method in the row. 

But in all OSs the first method remains while it believes the radius server is contactable. 

One exception is comware which has a complicated domain system of you choose to invoke. You can have a second domain that uses local first while the primary goes to radius. Here you allow the less secure method all the time so likely put other mechanisms in place to protect like extra secure passwords and ACLs to restrict which subnet can SSH. 

Hi IAN,

Thanks for your answer,

Do I need these two lines?

aaa port-access authenticator 1 tx-period 10

aaa port-access authenticator 1 client-limit 2

Thanks
ML

Hi, on the first of these questions, this is by design and desired by most. If the switch has a route to the IP of the radius server it will use that method solely. It falls to the next method in the line (local in your case) when it can't get to the radius server. 

This is good because you don't allow an insecure method permanently. This is one that can be brute forced. It allows the actual admin to be recorded against actions and not anyone who knows the local password. 

The behaviour changes depending on OS. For old procurve the switch tries to get a radius response about 7 times, then allows local credentials. If health checking radius server is available (like CX) then a failed health check drops you to the next method in the row. 

But in all OSs the first method remains while it believes the radius server is contactable. 

One exception is comware which has a complicated domain system of you choose to invoke. You can have a second domain that uses local first while the primary goes to radius. Here you allow the less secure method all the time so likely put other mechanisms in place to protect like extra secure passwords and ACLs to restrict which subnet can SSH. 

Hi IAN,

Thanks for your answer,

Do I need these two lines?

aaa port-access authenticator 1 tx-period 10

aaa port-access authenticator 1 client-limit 2

Thanks
ML

Hi, on the first of these questions, this is by design and desired by most. If the switch has a route to the IP of the radius server it will use that method solely. It falls to the next method in the line (local in your case) when it can't get to the radius server. 

This is good because you don't allow an insecure method permanently. This is one that can be brute forced. It allows the actual admin to be recorded against actions and not anyone who knows the local password. 

The behaviour changes depending on OS. For old procurve the switch tries to get a radius response about 7 times, then allows local credentials. If health checking radius server is available (like CX) then a failed health check drops you to the next method in the row. 

But in all OSs the first method remains while it believes the radius server is contactable. 

One exception is comware which has a complicated domain system of you choose to invoke. You can have a second domain that uses local first while the primary goes to radius. Here you allow the less secure method all the time so likely put other mechanisms in place to protect like extra secure passwords and ACLs to restrict which subnet can SSH. 

Answered as well in this duplicate post:

aaa port-access is for 802.1X authentication of devices that connect to your switch (interface 1 in your example) and it not related to SSH or Web login. If your NPS is not configures to respond to device authentication, you probably can't connect to interface 1.

port-access authenticator = 802.1X
port-access mac-based = MAC Authentication (MAB)

and you can configure both on the same port to provide 802.1X authentication for clients/devices that support it, and fallback to MAC authentication for devices that can't do 802.1X.

So, if you just want to do authentication of your admins using SSH to the switch, you can remove all of the port-access configuration.

Hi IAN,

Thanks for your answer,

Do I need these two lines?

aaa port-access authenticator 1 tx-period 10

aaa port-access authenticator 1 client-limit 2

Thanks
ML

Hi, on the first of these questions, this is by design and desired by most. If the switch has a route to the IP of the radius server it will use that method solely. It falls to the next method in the line (local in your case) when it can't get to the radius server. 

This is good because you don't allow an insecure method permanently. This is one that can be brute forced. It allows the actual admin to be recorded against actions and not anyone who knows the local password. 

The behaviour changes depending on OS. For old procurve the switch tries to get a radius response about 7 times, then allows local credentials. If health checking radius server is available (like CX) then a failed health check drops you to the next method in the row. 

But in all OSs the first method remains while it believes the radius server is contactable. 

One exception is comware which has a complicated domain system of you choose to invoke. You can have a second domain that uses local first while the primary goes to radius. Here you allow the less secure method all the time so likely put other mechanisms in place to protect like extra secure passwords and ACLs to restrict which subnet can SSH. 

Answered as well in this duplicate post:

aaa port-access is for 802.1X authentication of devices that connect to your switch (interface 1 in your example) and it not related to SSH or Web login. If your NPS is not configures to respond to device authentication, you probably can't connect to interface 1.

port-access authenticator = 802.1X
port-access mac-based = MAC Authentication (MAB)

and you can configure both on the same port to provide 802.1X authentication for clients/devices that support it, and fallback to MAC authentication for devices that can't do 802.1X.

So, if you just want to do authentication of your admins using SSH to the switch, you can remove all of the port-access configuration.

Hi IAN,

Thanks for your answer,

Do I need these two lines?

aaa port-access authenticator 1 tx-period 10

aaa port-access authenticator 1 client-limit 2

Thanks
ML

Hi, on the first of these questions, this is by design and desired by most. If the switch has a route to the IP of the radius server it will use that method solely. It falls to the next method in the line (local in your case) when it can't get to the radius server. 

This is good because you don't allow an insecure method permanently. This is one that can be brute forced. It allows the actual admin to be recorded against actions and not anyone who knows the local password. 

The behaviour changes depending on OS. For old procurve the switch tries to get a radius response about 7 times, then allows local credentials. If health checking radius server is available (like CX) then a failed health check drops you to the next method in the row. 

But in all OSs the first method remains while it believes the radius server is contactable. 

One exception is comware which has a complicated domain system of you choose to invoke. You can have a second domain that uses local first while the primary goes to radius. Here you allow the less secure method all the time so likely put other mechanisms in place to protect like extra secure passwords and ACLs to restrict which subnet can SSH. 

Answered as well in this duplicate post:

aaa port-access is for 802.1X authentication of devices that connect to your switch (interface 1 in your example) and it not related to SSH or Web login. If your NPS is not configures to respond to device authentication, you probably can't connect to interface 1.

port-access authenticator = 802.1X
port-access mac-based = MAC Authentication (MAB)

and you can configure both on the same port to provide 802.1X authentication for clients/devices that support it, and fallback to MAC authentication for devices that can't do 802.1X.

So, if you just want to do authentication of your admins using SSH to the switch, you can remove all of the port-access configuration.

Hi IAN,

Thanks for your answer,

Do I need these two lines?

aaa port-access authenticator 1 tx-period 10

aaa port-access authenticator 1 client-limit 2

Thanks
ML

Hi, on the first of these questions, this is by design and desired by most. If the switch has a route to the IP of the radius server it will use that method solely. It falls to the next method in the line (local in your case) when it can't get to the radius server. 

This is good because you don't allow an insecure method permanently. This is one that can be brute forced. It allows the actual admin to be recorded against actions and not anyone who knows the local password. 

The behaviour changes depending on OS. For old procurve the switch tries to get a radius response about 7 times, then allows local credentials. If health checking radius server is available (like CX) then a failed health check drops you to the next method in the row. 

But in all OSs the first method remains while it believes the radius server is contactable. 

One exception is comware which has a complicated domain system of you choose to invoke. You can have a second domain that uses local first while the primary goes to radius. Here you allow the less secure method all the time so likely put other mechanisms in place to protect like extra secure passwords and ACLs to restrict which subnet can SSH. 

@HR-abaef5 

Hi Herman,

I think it is all working fine. 

Also, how can I do the actual logging or recording for any changes done by network admin >?

thanks a lot

ML

Answered as well in this duplicate post:

aaa port-access is for 802.1X authentication of devices that connect to your switch (interface 1 in your example) and it not related to SSH or Web login. If your NPS is not configures to respond to device authentication, you probably can't connect to interface 1.

port-access authenticator = 802.1X
port-access mac-based = MAC Authentication (MAB)

and you can configure both on the same port to provide 802.1X authentication for clients/devices that support it, and fallback to MAC authentication for devices that can't do 802.1X.

So, if you just want to do authentication of your admins using SSH to the switch, you can remove all of the port-access configuration.

Hi IAN,

Thanks for your answer,

Do I need these two lines?

aaa port-access authenticator 1 tx-period 10

aaa port-access authenticator 1 client-limit 2

Thanks
ML

Hi, on the first of these questions, this is by design and desired by most. If the switch has a route to the IP of the radius server it will use that method solely. It falls to the next method in the line (local in your case) when it can't get to the radius server. 

This is good because you don't allow an insecure method permanently. This is one that can be brute forced. It allows the actual admin to be recorded against actions and not anyone who knows the local password. 

The behaviour changes depending on OS. For old procurve the switch tries to get a radius response about 7 times, then allows local credentials. If health checking radius server is available (like CX) then a failed health check drops you to the next method in the row. 

But in all OSs the first method remains while it believes the radius server is contactable. 

One exception is comware which has a complicated domain system of you choose to invoke. You can have a second domain that uses local first while the primary goes to radius. Here you allow the less secure method all the time so likely put other mechanisms in place to protect like extra secure passwords and ACLs to restrict which subnet can SSH. 

As far as I know, for command accounting on ArubaOS Switch you would need to change to TACACS instead of RADIUS for your admin login. You may check with support if that is indeed the case.

For the keys, you may try the include-credentials command:

sw01-12p(config)# include-credentials clearpass-key         Include ClearPass key along with other sensitive keys in the show configuration. radius-tacacs-only    Include RADIUS and TACACS+ credentials when saving configuration files remotely. store-in-config       Store passwords and SSH authorized keys in the configuration files. <cr>

With 'no include-credentials', I would expect the radius secrets (and other) no longer visible in the configuration.

Or are you on AOS-CX or other switch operating system?

@HR-abaef5 

Hi Herman,

I think it is all working fine. 

Also, how can I do the actual logging or recording for any changes done by network admin >?

thanks a lot

ML

Answered as well in this duplicate post:

aaa port-access is for 802.1X authentication of devices that connect to your switch (interface 1 in your example) and it not related to SSH or Web login. If your NPS is not configures to respond to device authentication, you probably can't connect to interface 1.

port-access authenticator = 802.1X
port-access mac-based = MAC Authentication (MAB)

and you can configure both on the same port to provide 802.1X authentication for clients/devices that support it, and fallback to MAC authentication for devices that can't do 802.1X.

So, if you just want to do authentication of your admins using SSH to the switch, you can remove all of the port-access configuration.

Hi IAN,

Thanks for your answer,

Do I need these two lines?

aaa port-access authenticator 1 tx-period 10

aaa port-access authenticator 1 client-limit 2

Thanks
ML

Hi, on the first of these questions, this is by design and desired by most. If the switch has a route to the IP of the radius server it will use that method solely. It falls to the next method in the line (local in your case) when it can't get to the radius server. 

This is good because you don't allow an insecure method permanently. This is one that can be brute forced. It allows the actual admin to be recorded against actions and not anyone who knows the local password. 

The behaviour changes depending on OS. For old procurve the switch tries to get a radius response about 7 times, then allows local credentials. If health checking radius server is available (like CX) then a failed health check drops you to the next method in the row. 

But in all OSs the first method remains while it believes the radius server is contactable. 

One exception is comware which has a complicated domain system of you choose to invoke. You can have a second domain that uses local first while the primary goes to radius. Here you allow the less secure method all the time so likely put other mechanisms in place to protect like extra secure passwords and ACLs to restrict which subnet can SSH. 

Answered as well in this duplicate post:

aaa port-access is for 802.1X authentication of devices that connect to your switch (interface 1 in your example) and it not related to SSH or Web login. If your NPS is not configures to respond to device authentication, you probably can't connect to interface 1.

port-access authenticator = 802.1X
port-access mac-based = MAC Authentication (MAB)

and you can configure both on the same port to provide 802.1X authentication for clients/devices that support it, and fallback to MAC authentication for devices that can't do 802.1X.

So, if you just want to do authentication of your admins using SSH to the switch, you can remove all of the port-access configuration.

Hi IAN,

Thanks for your answer,

Do I need these two lines?

aaa port-access authenticator 1 tx-period 10

aaa port-access authenticator 1 client-limit 2

Thanks
ML

Hi, on the first of these questions, this is by design and desired by most. If the switch has a route to the IP of the radius server it will use that method solely. It falls to the next method in the line (local in your case) when it can't get to the radius server. 

This is good because you don't allow an insecure method permanently. This is one that can be brute forced. It allows the actual admin to be recorded against actions and not anyone who knows the local password. 

The behaviour changes depending on OS. For old procurve the switch tries to get a radius response about 7 times, then allows local credentials. If health checking radius server is available (like CX) then a failed health check drops you to the next method in the row. 

But in all OSs the first method remains while it believes the radius server is contactable. 

One exception is comware which has a complicated domain system of you choose to invoke. You can have a second domain that uses local first while the primary goes to radius. Here you allow the less secure method all the time so likely put other mechanisms in place to protect like extra secure passwords and ACLs to restrict which subnet can SSH. 

Also, with this line, radius-server host 192.168.0.55 key "xxxxxxx", how can I encrypt this key? 

Thanks,

ML

Answered as well in this duplicate post:

aaa port-access is for 802.1X authentication of devices that connect to your switch (interface 1 in your example) and it not related to SSH or Web login. If your NPS is not configures to respond to device authentication, you probably can't connect to interface 1.

port-access authenticator = 802.1X
port-access mac-based = MAC Authentication (MAB)

and you can configure both on the same port to provide 802.1X authentication for clients/devices that support it, and fallback to MAC authentication for devices that can't do 802.1X.

So, if you just want to do authentication of your admins using SSH to the switch, you can remove all of the port-access configuration.

Hi IAN,

Thanks for your answer,

Do I need these two lines?

aaa port-access authenticator 1 tx-period 10

aaa port-access authenticator 1 client-limit 2

Thanks
ML

Hi, on the first of these questions, this is by design and desired by most. If the switch has a route to the IP of the radius server it will use that method solely. It falls to the next method in the line (local in your case) when it can't get to the radius server. 

This is good because you don't allow an insecure method permanently. This is one that can be brute forced. It allows the actual admin to be recorded against actions and not anyone who knows the local password. 

The behaviour changes depending on OS. For old procurve the switch tries to get a radius response about 7 times, then allows local credentials. If health checking radius server is available (like CX) then a failed health check drops you to the next method in the row. 

But in all OSs the first method remains while it believes the radius server is contactable. 

One exception is comware which has a complicated domain system of you choose to invoke. You can have a second domain that uses local first while the primary goes to radius. Here you allow the less secure method all the time so likely put other mechanisms in place to protect like extra secure passwords and ACLs to restrict which subnet can SSH.