using radius to authenticate telnet sessions

[eclidad]

Hi,

We are having problems getting our radius authentication running. Right now we only use it for VPN connections. My understanding is that I can only test this from outside our office. This despite the fact we have 2 wan connections on out 1841. It would be nice to go out one and back in the other and do it all from the comfort of my desk. Plan B is to set up a user that needs RADIUS to authenticate a telnet session to the router. Then I could snoop packets and debug much faster. What "aaa" and "username" commands do I need to enter to support this? This is what I have now

aaa new-model
!
!
aaa authentication login default local
aaa authentication login userauthen group radius local
aaa authorization exec default local
aaa authorization network groupauthor local
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor


Thanks,
- Joel

 

[eclidad]

I found what I needed but not what I was hoping for. If you do

aaa authentication login default group radius local

It checks in with the radius server. I wanted to see this happen before I headed out of the office. More than that, I wanted responses to get back to the router. What I'd like to see is that it first looks in radius and if that fails it looks in the local database. The user to manage the server is not in radius. For now we only use radius to manage accounts that will use the VPN.

- Joel

 

[ADB100]

This is the expected behaviour. The AAA lists are in order of preference - i.e. 'radius local' as you have. Radius is tried first, assuming the radius server is operational (i.e. it's online and the keys are correct) then a user logon challenge will result in a Pass or a Fail. If its a Pass then the user authenticates, if its a fail then the user gets a failed authentication. If the Radius server is offline or you have misconfigured the keys then the Radius server will effectively not respond. In this case the router will try the next option in the list - in your case 'local'. If there is a local user configured then you will pass authentication, if the user is not configured or the password is wrong then you fail.
There used to be a 'local override' option but this was removed a long time ago (maybe IOS 12.0?).

This is just how it works. Add the user to Radius.

Andy