Security

Hello together,

I've got a question regarding radsec and radius change of authorization.

Current Scenario:

• Campus using Aruba 2930F switches version 10.11.0026  and Clearpass 6.12.6
• classic Radius without radsec works well, including CoA
• we're testing radsec with one non-productive switch, radsec itself works well,  only CoA doesn't work

CoA is enabled for network device within Clearpass and also in switch config using "radius-server host <cppm.fqdn> tls dyn-authorization.

When trying to run a port-bounce with CoA, I get an error, stating "No response from network device", switch doesn't show any action.

Does anybody know about any general limitations or issue with the switches for CoA over radsec? I checked the relase notes for both, but no related issue found. Firewall doesn't discard any packet 

Greetings Railway

Have you attempted a packet capture at the switch to see what is being received?

If the switch is receiving the relevant packets, open a case with TAC to determine what is wrong.

Hello together,

I've got a question regarding radsec and radius change of authorization.

Current Scenario:

• Campus using Aruba 2930F switches version 10.11.0026  and Clearpass 6.12.6
• classic Radius without radsec works well, including CoA
• we're testing radsec with one non-productive switch, radsec itself works well,  only CoA doesn't work

CoA is enabled for network device within Clearpass and also in switch config using "radius-server host <cppm.fqdn> tls dyn-authorization.

When trying to run a port-bounce with CoA, I get an error, stating "No response from network device", switch doesn't show any action.

Does anybody know about any general limitations or issue with the switches for CoA over radsec? I checked the relase notes for both, but no related issue found. Firewall doesn't discard any packet 

Greetings Railway

I have many 2930F/M switches deployed with RADsec and CoA work as expected with Clearpass.

My standard configuration is like this:

radius-server host 172.16.xx.xx tls clearpass
radius-server host 172.16.xx.xx tls dyn-authorization
radius-server host 172.16.xx.xx tls time-window plus-or-minus-time-window
radius-server host 172.16.xx.xx tls time-window 3600
aaa server-group radius "Clearpass" host 172.16.xx.xx tls

Best, Gorazd

Have you attempted a packet capture at the switch to see what is being received?

If the switch is receiving the relevant packets, open a case with TAC to determine what is wrong.

Hello together,

I've got a question regarding radsec and radius change of authorization.

Current Scenario:

• Campus using Aruba 2930F switches version 10.11.0026  and Clearpass 6.12.6
• classic Radius without radsec works well, including CoA
• we're testing radsec with one non-productive switch, radsec itself works well,  only CoA doesn't work

CoA is enabled for network device within Clearpass and also in switch config using "radius-server host <cppm.fqdn> tls dyn-authorization.

When trying to run a port-bounce with CoA, I get an error, stating "No response from network device", switch doesn't show any action.

Does anybody know about any general limitations or issue with the switches for CoA over radsec? I checked the relase notes for both, but no related issue found. Firewall doesn't discard any packet 

Greetings Railway

Hello together,

I've got a question regarding radsec and radius change of authorization.

Current Scenario:

• Campus using Aruba 2930F switches version 10.11.0026  and Clearpass 6.12.6
• classic Radius without radsec works well, including CoA
• we're testing radsec with one non-productive switch, radsec itself works well,  only CoA doesn't work

CoA is enabled for network device within Clearpass and also in switch config using "radius-server host <cppm.fqdn> tls dyn-authorization.

When trying to run a port-bounce with CoA, I get an error, stating "No response from network device", switch doesn't show any action.

Does anybody know about any general limitations or issue with the switches for CoA over radsec? I checked the relase notes for both, but no related issue found. Firewall doesn't discard any packet 

Greetings Railway

Hello,

Hello together,

I've got a question regarding radsec and radius change of authorization.

Current Scenario:

• Campus using Aruba 2930F switches version 10.11.0026  and Clearpass 6.12.6
• classic Radius without radsec works well, including CoA
• we're testing radsec with one non-productive switch, radsec itself works well,  only CoA doesn't work

CoA is enabled for network device within Clearpass and also in switch config using "radius-server host <cppm.fqdn> tls dyn-authorization.

When trying to run a port-bounce with CoA, I get an error, stating "No response from network device", switch doesn't show any action.

Does anybody know about any general limitations or issue with the switches for CoA over radsec? I checked the relase notes for both, but no related issue found. Firewall doesn't discard any packet 

Greetings Railway

To mitigate tunnel closure you should deploy radius tracking option. Switch will trigger dummy authorization request to keep tunnel open. 

You can create a tracker user account and service on Clearpass so you won't get all test requests in red :-) It really doesn't matter if request is accept or reject as switch is only looking for radius response.

Best, Gorazd

Hello,

Hello together,

I've got a question regarding radsec and radius change of authorization.

Current Scenario:

• Campus using Aruba 2930F switches version 10.11.0026  and Clearpass 6.12.6
• classic Radius without radsec works well, including CoA
• we're testing radsec with one non-productive switch, radsec itself works well,  only CoA doesn't work

CoA is enabled for network device within Clearpass and also in switch config using "radius-server host <cppm.fqdn> tls dyn-authorization.

When trying to run a port-bounce with CoA, I get an error, stating "No response from network device", switch doesn't show any action.

Does anybody know about any general limitations or issue with the switches for CoA over radsec? I checked the relase notes for both, but no related issue found. Firewall doesn't discard any packet 

Greetings Railway

Hello together,

first of all: big thanks for your quick answers!  I'm gonna test it on Monday onsite and keep you updated :-) If nothing helps, I'll do a packet capture at the switch uplink and open a case.

@GorazdKikelj: Good to know you have a working reference, so I can expect a config issue in my setup, that makes troubleshooting lots easier. I've got same firmware as you, we just started config on 10.11.0026, shouldn't be that different. Switch has been factory defaulted before. I'll check with the radius tracking, it's on the bucket list anyway.

@muhittin: The certificate part works as expected, CPPM and switch got a cert from a trusted CA, both end show connection as up. I'll add another firewall rule from Clearpass to switch, current one's vice versa, maybe connection attempt gets dropped without log in firewall.

To mitigate tunnel closure you should deploy radius tracking option. Switch will trigger dummy authorization request to keep tunnel open. 

You can create a tracker user account and service on Clearpass so you won't get all test requests in red :-) It really doesn't matter if request is accept or reject as switch is only looking for radius response.

Best, Gorazd

Hello,

Hello together,

I've got a question regarding radsec and radius change of authorization.

Current Scenario:

• Campus using Aruba 2930F switches version 10.11.0026  and Clearpass 6.12.6
• classic Radius without radsec works well, including CoA
• we're testing radsec with one non-productive switch, radsec itself works well,  only CoA doesn't work

CoA is enabled for network device within Clearpass and also in switch config using "radius-server host <cppm.fqdn> tls dyn-authorization.

When trying to run a port-bounce with CoA, I get an error, stating "No response from network device", switch doesn't show any action.

Does anybody know about any general limitations or issue with the switches for CoA over radsec? I checked the relase notes for both, but no related issue found. Firewall doesn't discard any packet 

Greetings Railway

You state the switch is a 2930F, that model runs AOS-S, I'm guessing you mean 16.11.26?

Have you tested everything without RadSec enabled first?  Have you looked at the event viewer to see if there is anything interesting or relevant?

Hello together,

first of all: big thanks for your quick answers!  I'm gonna test it on Monday onsite and keep you updated :-) If nothing helps, I'll do a packet capture at the switch uplink and open a case.

@GorazdKikelj: Good to know you have a working reference, so I can expect a config issue in my setup, that makes troubleshooting lots easier. I've got same firmware as you, we just started config on 10.11.0026, shouldn't be that different. Switch has been factory defaulted before. I'll check with the radius tracking, it's on the bucket list anyway.

@muhittin: The certificate part works as expected, CPPM and switch got a cert from a trusted CA, both end show connection as up. I'll add another firewall rule from Clearpass to switch, current one's vice versa, maybe connection attempt gets dropped without log in firewall.

To mitigate tunnel closure you should deploy radius tracking option. Switch will trigger dummy authorization request to keep tunnel open. 

You can create a tracker user account and service on Clearpass so you won't get all test requests in red :-) It really doesn't matter if request is accept or reject as switch is only looking for radius response.

Best, Gorazd

Hello,

Hello together,

I've got a question regarding radsec and radius change of authorization.

Current Scenario:

• Campus using Aruba 2930F switches version 10.11.0026  and Clearpass 6.12.6
• classic Radius without radsec works well, including CoA
• we're testing radsec with one non-productive switch, radsec itself works well,  only CoA doesn't work

CoA is enabled for network device within Clearpass and also in switch config using "radius-server host <cppm.fqdn> tls dyn-authorization.

When trying to run a port-bounce with CoA, I get an error, stating "No response from network device", switch doesn't show any action.

Does anybody know about any general limitations or issue with the switches for CoA over radsec? I checked the relase notes for both, but no related issue found. Firewall doesn't discard any packet 

Greetings Railway

Hello Carson,

correct, it's 10.11.26 on AOS-S

We've tested everything before, the productive environment still runs with classic radius without any issues. The test switch with radsec uses the same config as the productive one, just differs in radius server settings.

Event viewer doesn't show any message after running CoA on Webgui. We use the same services for productive and radsec.

As mentioned in previous post, I guess it's a config issue on the switch, I'll check radius tracking, open the firewall port and the config samples from Gorazd on Monday. If everything fails, I'll grab a packetcapture and open a case.

You state the switch is a 2930F, that model runs AOS-S, I'm guessing you mean 16.11.26?

Have you tested everything without RadSec enabled first?  Have you looked at the event viewer to see if there is anything interesting or relevant?

Hello together,

first of all: big thanks for your quick answers!  I'm gonna test it on Monday onsite and keep you updated :-) If nothing helps, I'll do a packet capture at the switch uplink and open a case.

@GorazdKikelj: Good to know you have a working reference, so I can expect a config issue in my setup, that makes troubleshooting lots easier. I've got same firmware as you, we just started config on 10.11.0026, shouldn't be that different. Switch has been factory defaulted before. I'll check with the radius tracking, it's on the bucket list anyway.

@muhittin: The certificate part works as expected, CPPM and switch got a cert from a trusted CA, both end show connection as up. I'll add another firewall rule from Clearpass to switch, current one's vice versa, maybe connection attempt gets dropped without log in firewall.

To mitigate tunnel closure you should deploy radius tracking option. Switch will trigger dummy authorization request to keep tunnel open. 

You can create a tracker user account and service on Clearpass so you won't get all test requests in red :-) It really doesn't matter if request is accept or reject as switch is only looking for radius response.

Best, Gorazd

Hello,

Hello together,

I've got a question regarding radsec and radius change of authorization.

Current Scenario:

• Campus using Aruba 2930F switches version 10.11.0026  and Clearpass 6.12.6
• classic Radius without radsec works well, including CoA
• we're testing radsec with one non-productive switch, radsec itself works well,  only CoA doesn't work

CoA is enabled for network device within Clearpass and also in switch config using "radius-server host <cppm.fqdn> tls dyn-authorization.

When trying to run a port-bounce with CoA, I get an error, stating "No response from network device", switch doesn't show any action.

Does anybody know about any general limitations or issue with the switches for CoA over radsec? I checked the relase notes for both, but no related issue found. Firewall doesn't discard any packet 

Greetings Railway

Hi @railway

You should also check in Event Viewer for IPsec tunnel UP/DOWN events. 

Best, Gorazd

Hello Carson,

correct, it's 10.11.26 on AOS-S

We've tested everything before, the productive environment still runs with classic radius without any issues. The test switch with radsec uses the same config as the productive one, just differs in radius server settings.

Event viewer doesn't show any message after running CoA on Webgui. We use the same services for productive and radsec.

As mentioned in previous post, I guess it's a config issue on the switch, I'll check radius tracking, open the firewall port and the config samples from Gorazd on Monday. If everything fails, I'll grab a packetcapture and open a case.

You state the switch is a 2930F, that model runs AOS-S, I'm guessing you mean 16.11.26?

Have you tested everything without RadSec enabled first?  Have you looked at the event viewer to see if there is anything interesting or relevant?

Hello together,

first of all: big thanks for your quick answers!  I'm gonna test it on Monday onsite and keep you updated :-) If nothing helps, I'll do a packet capture at the switch uplink and open a case.

@GorazdKikelj: Good to know you have a working reference, so I can expect a config issue in my setup, that makes troubleshooting lots easier. I've got same firmware as you, we just started config on 10.11.0026, shouldn't be that different. Switch has been factory defaulted before. I'll check with the radius tracking, it's on the bucket list anyway.

@muhittin: The certificate part works as expected, CPPM and switch got a cert from a trusted CA, both end show connection as up. I'll add another firewall rule from Clearpass to switch, current one's vice versa, maybe connection attempt gets dropped without log in firewall.

To mitigate tunnel closure you should deploy radius tracking option. Switch will trigger dummy authorization request to keep tunnel open. 

You can create a tracker user account and service on Clearpass so you won't get all test requests in red :-) It really doesn't matter if request is accept or reject as switch is only looking for radius response.

Best, Gorazd

Hello,

Hello together,

I've got a question regarding radsec and radius change of authorization.

Current Scenario:

• Campus using Aruba 2930F switches version 10.11.0026  and Clearpass 6.12.6
• classic Radius without radsec works well, including CoA
• we're testing radsec with one non-productive switch, radsec itself works well,  only CoA doesn't work

CoA is enabled for network device within Clearpass and also in switch config using "radius-server host <cppm.fqdn> tls dyn-authorization.

When trying to run a port-bounce with CoA, I get an error, stating "No response from network device", switch doesn't show any action.

Does anybody know about any general limitations or issue with the switches for CoA over radsec? I checked the relase notes for both, but no related issue found. Firewall doesn't discard any packet 

Greetings Railway

Hello together,
as written before, you'll get an update today:

• Switched the config to IP adress instead of FQDN using the config provided by Gorazd 
• Had a deeper look at the switch, either logs and also "debug all", it's working now, client gets disconnected, just Clearpass still shows "No response from network device"
  Client definitely re-authenticates, it's visible in access tracker
• Firewall allows 2083 tcp in both directions, don't see any connections sourcing Clearpass, but expected that as the switch initiates the conncetion
• Re-checked the certificates, the one for CPPM contains dns-name, IP-Address, IP as DNS-Address, Key usage for TLS Server Authenticaton and EAP over LAN
  Cert for Switch is valid for TLS Client Authentication
• Disabling certificate validation for the radsec device makes no change
• radsec connection stays up at both ends
• it makes no difference if I use radius tracking or not

As it is now just an annoying optical bug, I'll open a case with TAC as soon as we've got some spare time, at least, we have an almost working configuration right now :-)

Big thanks for your kind support and config snippets!

Hi @railway

You should also check in Event Viewer for IPsec tunnel UP/DOWN events. 

Best, Gorazd

Hello Carson,

correct, it's 10.11.26 on AOS-S

We've tested everything before, the productive environment still runs with classic radius without any issues. The test switch with radsec uses the same config as the productive one, just differs in radius server settings.

Event viewer doesn't show any message after running CoA on Webgui. We use the same services for productive and radsec.

As mentioned in previous post, I guess it's a config issue on the switch, I'll check radius tracking, open the firewall port and the config samples from Gorazd on Monday. If everything fails, I'll grab a packetcapture and open a case.

You state the switch is a 2930F, that model runs AOS-S, I'm guessing you mean 16.11.26?

Have you tested everything without RadSec enabled first?  Have you looked at the event viewer to see if there is anything interesting or relevant?

Hello together,

first of all: big thanks for your quick answers!  I'm gonna test it on Monday onsite and keep you updated :-) If nothing helps, I'll do a packet capture at the switch uplink and open a case.

@GorazdKikelj: Good to know you have a working reference, so I can expect a config issue in my setup, that makes troubleshooting lots easier. I've got same firmware as you, we just started config on 10.11.0026, shouldn't be that different. Switch has been factory defaulted before. I'll check with the radius tracking, it's on the bucket list anyway.

@muhittin: The certificate part works as expected, CPPM and switch got a cert from a trusted CA, both end show connection as up. I'll add another firewall rule from Clearpass to switch, current one's vice versa, maybe connection attempt gets dropped without log in firewall.

To mitigate tunnel closure you should deploy radius tracking option. Switch will trigger dummy authorization request to keep tunnel open. 

You can create a tracker user account and service on Clearpass so you won't get all test requests in red :-) It really doesn't matter if request is accept or reject as switch is only looking for radius response.

Best, Gorazd

Hello,

Hello together,

I've got a question regarding radsec and radius change of authorization.

Current Scenario:

• Campus using Aruba 2930F switches version 10.11.0026  and Clearpass 6.12.6
• classic Radius without radsec works well, including CoA
• we're testing radsec with one non-productive switch, radsec itself works well,  only CoA doesn't work

CoA is enabled for network device within Clearpass and also in switch config using "radius-server host <cppm.fqdn> tls dyn-authorization.

When trying to run a port-bounce with CoA, I get an error, stating "No response from network device", switch doesn't show any action.

Does anybody know about any general limitations or issue with the switches for CoA over radsec? I checked the relase notes for both, but no related issue found. Firewall doesn't discard any packet 

Greetings Railway