Network Management

 View Only

  • 1.  OS-CX and RADIUS using Microsoft NPS for admin access

    Posted Mar 25, 2022 11:09 AM
    Hi all,

    Apologies if this has been asked before, I've been searching but had no luck so far. I'm hoping to set up radius authentication for the Aruba OS-CX switches using Microsoft NPS for admin access but am struggling to find any decent guides. Is there a step-by-step anywhere on how to configure this?

    Thanks

    ------------------------------
    Neil Behagg
    ------------------------------


  • 2.  RE: OS-CX and RADIUS using Microsoft NPS for admin access

    Posted Mar 28, 2022 10:31 AM
    We also do radius authentication for all of our network gear to load balanced NPS servers.   What I've found to this point is that OS-CX does not support the common method we're using with radius which is PEAP-MSChapV2 but requires EAP-TLS.    This is a pending project on my list to resolve, so I don't really have much more info I can provide.

    ------------------------------
    Brian Seppanen
    ------------------------------

    Original Message


  • 3.  RE: OS-CX and RADIUS using Microsoft NPS for admin access
    Best Answer

    Posted Mar 29, 2022 12:52 PM
    Edited by neilb123 Mar 30, 2022 07:04 AM
    Hi Neil,

    Aruba-CX also use the shell:priv-lvl:15 methode, maybe this topic helps you.

    https://www.expertnetworkconsultant.com/configuring/network-device-management-with-radius-authentication-using-windows-nps/

    Edit: I can confirm you that i test the above solution for you on a Aruba-CX virtual switch and it's working.

    Switch configuration below:
    radius-server host "IP of NPS Server" key ***

!
aaa group server radius nps
    server "IP of NPS Server"
!
aaa authentication login default group nps local
!
​


    ------------------------------
    Marcel Koedijk | MVP Expert 2022 | ACEP | ACMP | ACCP | ACDP | Ekahau ECSE | Not an HPE Employee | Opinions are my own
    ------------------------------

    Original Message


  • 4.  RE: OS-CX and RADIUS using Microsoft NPS for admin access

    Posted Mar 30, 2022 07:05 AM
    Thanks Marcel, that was a huge help!

    ------------------------------
    Neil Behagg
    ------------------------------

    Original Message


  • 5.  RE: OS-CX and RADIUS using Microsoft NPS for admin access

    Posted Nov 16, 2022 11:18 AM

    I can't figure out how to get it to use something other than pap/chap.  I tried configuring:

    radius-server host tls, I have a certificate assigned to the radsec application.  Doesn't work.  It just keeps sending PAP.

    The only way I can login to a CX switch is enabling an unencrypted protocol on my NPS server.

    Worked fine on older gen Aruba switches using peap-mschapv2.


    Original Message


  • 6.  RE: OS-CX and RADIUS using Microsoft NPS for admin access

    Posted Sep 05, 2023 05:02 PM

    I'm well aware I'm reviving an old thread, however:

    I can't get this to work.
    We have a large multi-tenant multi-vendor environment and it works for everyone (including 2930F's and other Aruba switch OS switches), except for the new CX switch I'm testing.

    Even with a separate Connection Request Policy where I specify "Accept users without validating credentials" the switch won't budge.
    I can see the Radius server sending an accept message back to the switch, however the switch just decides to return Access denied.

    Am I missing something in your explanation mkk?


    Original Message


  • 7.  RE: OS-CX and RADIUS using Microsoft NPS for admin access

    Posted Sep 06, 2023 03:49 AM

    Its not clear if you talk about port authentication or switch logon access.

    -port authentication: use EAP-TLS or EAP-PEAP (less secure).

    -switch logon: use PAP

    Since you get a RADIUS ACCEPT message you NPS reveice the request from the switch and your authentication method is allready proced. You pasted the secutiy policy and the NPS service decide to send you a RADIUS ACCEPT, all done for the NPS server.

    Issue could be:

    1. Your NPS RADIUS ACCEPT sending the wrong attributes back, based on the NPS Policy hit.
    2. Your Switch don't understand the RADIUS ACCEPT attributes it ask for.

    For switch login make sure you use the Cisco-AV specific shell:priv-lvl:15, as descriped in the link above.

    As this thread is very old i would advice to open a new one.



    ------------------------------
    Marcel Koedijk | MVP Expert 2023 | ACEP | ACMP | ACCP | ACDP | Ekahau ECSE | Not an HPE Employee | Opinions are my own
    ------------------------------

    Original Message


  • 8.  RE: OS-CX and RADIUS using Microsoft NPS for admin access

    Posted Sep 06, 2023 08:54 AM
    Switch Configuration:
    clock timezone <Your Time Zone>
    ntp server <NTP Server 1> iburst version 3 minpoll 4 maxpoll 4 prefer
    ntp server <NTP Server 2> iburst version 3 minpoll 4 maxpoll 4
    no ntp server pool.ntp.org
    ntp enable
    radius-server host <NPS1> vrf <mgmt|default> key plaintext <PSK>
    radius-server host <NPS2> vrf <mgmt|default> key plaintext <PSK>
     
    aaa group server radius NPS-RADIUS
    server <NPS1> vrf <mgmt|default>
    server <NPS2> vrf <mgmt|default>
     
    aaa authentication login console group NPS-RADIUS local
    aaa authentication login default group NPS-RADIUS local
    aaa authentication login ssh group NPS-RADIUS local
    aaa authentication login https-server group NPS-RADIUS local
    aaa radius-attribute group NPS-RADIUS
    aaa authentication limit-login-attempts 3 lockout-time 5
    https-server max-user-sessions 2
    https-server session-timeout 15
    cli-session
       max-per-user 2
       timeout 45
    exit

    NPS Configuration: 

    For NPS make sure you're sending back the additional VSA for Aruba-Priv-Admin-User 15

    https://community.arubanetworks.com/community-home/digestviewer/viewthread?GroupId=25&MessageKey=cceb5ac0-bf31-4711-bc54-5ad539b154de&CommunityKey=22dc38ea-a1e1-4059-b55e-a622fedecf32&tab=digestviewer 

    Check Here for other NPS configuration information. 

    https://community.arubanetworks.com/community-home/digestviewer/viewthread?MID=10129


    Original Message


  • 9.  RE: OS-CX and RADIUS using Microsoft NPS for admin access

    Posted Sep 07, 2023 02:59 AM
    Edited by pieterm Sep 07, 2023 03:00 AM

    Thanks, I got it to work now.
    But it seems this is only PAP, Which is unencrypted between the User and the NAS Client.
    The next step would be TLS (RadSec) but Windows NPS doesn't support this.
    We're looking at other AAA options now that do work with Aruba CX.

    Nevertheless, mholden and mkk, thank you for the elaborate answer.


    Original Message


Related Content