Security

 View Only

  • 1.  Aruba R8N88A Duo Issues

    Posted Nov 12, 2025 10:31 AM

    We are a cisco shop running 3850s, we are going to be migrating over to Aruba here soon. I have been playing around with one of the aruba switches we have received and am trying to get it setup with Duo. We run a duo auth proxy on a NETPS server. I have configured the backend and am able to receive authentications and accept them, but afterwards I am receiving an error, "Access denied". I have checked the logs on the server and can see where my authentication was approved and returned back to the switch. I know I'm missing something but I'm not sure where to look. Any advice is appreciated.



    -------------------------------------------


  • 2.  RE: Aruba R8N88A Duo Issues

    Posted Nov 14, 2025 08:10 AM

    Hello @JS-uDq358

    Duo returns a RADIUS Access Accept, but the CX 6000 doesn't see any administrative role attributes in the response (such as Aruba-Admin-Role, Aruba-Priv-Admin-User, or Administrative-User/NAS-Prompt-User as the Service Type). On AOS-CX, if no roles can be derived from these attributes, the switch treats the user as "unauthenticated," and you'll see an "Access denied" message, even if Duo reports successful authentication.
     
    Recommended design:
     
    Use NPS as the actual RADIUS server for the switch and add Duo as MFA.
     
    Return an Aruba role VSA in your NPS Network Policies for the switch:
     
    Vendor = 14823 (Aruba)
     
    Attribute = 4 (Aruba-Administrator-Role), String
     
    Value = administrators or operators
     
    Optionally, you can also set Service Type = Administrative and Login Service = SSH.
     
    On the CX 6000, configure the following:
     
    radius-server host <NPS_IP> switch <secret>
    aaa group server radius NPS-GRP
    server <NPS_IP>
    aaa authentication login ssh group NPS-GRP local
    aaa authentication login console group NPS-GRP local
    aaa authentication login https-server group NPS-GRP local
     
    From now on, Duo will continue processing the second factor, but the final RADIUS Access-Accept sent by NPS will include the appropriate Aruba VSAs so the switch can map you to the administrators (or other) local user group instead of denying access.
     
    You may find the following documents helpful:
     
    https://arubanetworking.hpe.com/techdocs/AOS-CX/10.11/HTML/security_8360/Content/Chp_Rem_AAA_RADIUS/rad-aut.htm
     
    https://arubanetworking.hpe.com/techdocs/AOS-CX/10.07/HTML/5200-7885/Content/Chp_Rem_AAA_RADIUS/use-rol-ass-usi-rad-att-10.htm
     
    https://www.reddit.com/r/ArubaNetworks/comments/1beynmi/duo_mfa_and_aruba_switch_authentication/
    -------------------------------------------



Related Content