Wired Intelligent Edge

We upgraded our 3810M from KB.16.10.0011 to KB.16.11.0002
prior to that, when we'd SSH into the switch, we'd authenticate via AAA server, then type in 'enable' and authenticate again (same creds).

After the upgrade, I can SSH & authenticate fine, but when I go do 'enable', and enter in creds, I get the "Access denied; maximum session limit for the user is reached." message

Even if I use a different identity for the enable than from the login, same message (in case there was some secret limit of 1)
On the Radius side, it shows it is authenticating / granting access each time.

I didn't see anything in the release notes around anything impacting aaa or radius.
I can get in by stopping the radius servers and using local accounts, but would be nice to have the AAA working properly again.

No changes to the commands done, still looks like:
aaa server-group radius "Auth1" host 192.168.5.10
aaa server-group radius "Auth1" host 192.168.5.11
aaa authentication ssh login radius server-group "Auth1" local
aaa authentication ssh enable radius server-group "Auth1" local

Wasn't finding much in the way of hits on the error message.

------------------------------
John Fedor
------------------------------

Please open a TAC case. This may be bug 254976, which was fixed in 16.10.0013, but as you are on 16.11 it may be something different as well.

You may consider getting users in enable mode right away, by setting the aaa authentication login privilege-mode (video here) and see if that helps.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------

Original Message:
Sent: Nov 15, 2021 10:21 AM
From: John Fedor
Subject: 3810M AAA error after upgrade - "Access denied; maximum session limit for the user is reached."

We upgraded our 3810M from KB.16.10.0011 to KB.16.11.0002
prior to that, when we'd SSH into the switch, we'd authenticate via AAA server, then type in 'enable' and authenticate again (same creds).

After the upgrade, I can SSH & authenticate fine, but when I go do 'enable', and enter in creds, I get the "Access denied; maximum session limit for the user is reached." message

Even if I use a different identity for the enable than from the login, same message (in case there was some secret limit of 1)
On the Radius side, it shows it is authenticating / granting access each time.

I didn't see anything in the release notes around anything impacting aaa or radius.
I can get in by stopping the radius servers and using local accounts, but would be nice to have the AAA working properly again.

No changes to the commands done, still looks like:
aaa server-group radius "Auth1" host 192.168.5.10
aaa server-group radius "Auth1" host 192.168.5.11
aaa authentication ssh login radius server-group "Auth1" local
aaa authentication ssh enable radius server-group "Auth1" local

Wasn't finding much in the way of hits on the error message.

------------------------------
John Fedor
------------------------------

Adding "aaa authentication login privilege-mode" actually made it worse somehow - shows that the Radius servers are approving the authentication request, but the switch keeps asking for the password like it didn't like it until fails after repeated attempts - this is for the initial SSH authentication, not the enable.

I'll see about going the TAC route.

Thanks.


------------------------------
John Fedor
------------------------------

Original Message:
Sent: Nov 16, 2021 07:07 AM
From: Herman Robers
Subject: 3810M AAA error after upgrade - "Access denied; maximum session limit for the user is reached."

Please open a TAC case. This may be bug 254976, which was fixed in 16.10.0013, but as you are on 16.11 it may be something different as well.

You may consider getting users in enable mode right away, by setting the aaa authentication login privilege-mode (video here) and see if that helps.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Nov 15, 2021 10:21 AM
From: John Fedor
Subject: 3810M AAA error after upgrade - "Access denied; maximum session limit for the user is reached."

We upgraded our 3810M from KB.16.10.0011 to KB.16.11.0002
prior to that, when we'd SSH into the switch, we'd authenticate via AAA server, then type in 'enable' and authenticate again (same creds).

After the upgrade, I can SSH & authenticate fine, but when I go do 'enable', and enter in creds, I get the "Access denied; maximum session limit for the user is reached." message

Even if I use a different identity for the enable than from the login, same message (in case there was some secret limit of 1)
On the Radius side, it shows it is authenticating / granting access each time.

I didn't see anything in the release notes around anything impacting aaa or radius.
I can get in by stopping the radius servers and using local accounts, but would be nice to have the AAA working properly again.

No changes to the commands done, still looks like:
aaa server-group radius "Auth1" host 192.168.5.10
aaa server-group radius "Auth1" host 192.168.5.11
aaa authentication ssh login radius server-group "Auth1" local
aaa authentication ssh enable radius server-group "Auth1" local

Wasn't finding much in the way of hits on the error message.

------------------------------
John Fedor
------------------------------

Hi. Were you able to get a resolution to this? I tried updating to 16.10.18 and it is giving me the same issue. I've downgraded firmware to a few different iterations (16.10.17, 16.10.4, 16.10.13, and 16.10.12) and all gave me the same issue trying to got to manager (enable) mode via ssh. Downgrading to 16.10.11 works fine. Release notes show that this was supposed to be fixed in 16.10.13, but that doesn't seem to be the case for me.

------------------------------
David Emmerich
------------------------------

Original Message:
Sent: Nov 17, 2021 12:12 AM
From: John Fedor
Subject: 3810M AAA error after upgrade - "Access denied; maximum session limit for the user is reached."

Adding "aaa authentication login privilege-mode" actually made it worse somehow - shows that the Radius servers are approving the authentication request, but the switch keeps asking for the password like it didn't like it until fails after repeated attempts - this is for the initial SSH authentication, not the enable.

I'll see about going the TAC route.

Thanks.


------------------------------
John Fedor

Original Message:
Sent: Nov 16, 2021 07:07 AM
From: Herman Robers
Subject: 3810M AAA error after upgrade - "Access denied; maximum session limit for the user is reached."

Please open a TAC case. This may be bug 254976, which was fixed in 16.10.0013, but as you are on 16.11 it may be something different as well.

You may consider getting users in enable mode right away, by setting the aaa authentication login privilege-mode (video here) and see if that helps.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Nov 15, 2021 10:21 AM
From: John Fedor
Subject: 3810M AAA error after upgrade - "Access denied; maximum session limit for the user is reached."

We upgraded our 3810M from KB.16.10.0011 to KB.16.11.0002
prior to that, when we'd SSH into the switch, we'd authenticate via AAA server, then type in 'enable' and authenticate again (same creds).

After the upgrade, I can SSH & authenticate fine, but when I go do 'enable', and enter in creds, I get the "Access denied; maximum session limit for the user is reached." message

Even if I use a different identity for the enable than from the login, same message (in case there was some secret limit of 1)
On the Radius side, it shows it is authenticating / granting access each time.

I didn't see anything in the release notes around anything impacting aaa or radius.
I can get in by stopping the radius servers and using local accounts, but would be nice to have the AAA working properly again.

No changes to the commands done, still looks like:
aaa server-group radius "Auth1" host 192.168.5.10
aaa server-group radius "Auth1" host 192.168.5.11
aaa authentication ssh login radius server-group "Auth1" local
aaa authentication ssh enable radius server-group "Auth1" local

Wasn't finding much in the way of hits on the error message.

------------------------------
John Fedor
------------------------------

Original Message:
Sent: 12/21/2021 2:46:00 PM
From: davidpe
Subject: RE: 3810M AAA error after upgrade - "Access denied; maximum session limit for the user is reached."

Hi. Were you able to get a resolution to this? I tried updating to 16.10.18 and it is giving me the same issue. I've downgraded firmware to a few different iterations (16.10.17, 16.10.4, 16.10.13, and 16.10.12) and all gave me the same issue trying to got to manager (enable) mode via ssh. Downgrading to 16.10.11 works fine. Release notes show that this was supposed to be fixed in 16.10.13, but that doesn't seem to be the case for me.

------------------------------
David Emmerich
------------------------------

Original Message:
Sent: Nov 17, 2021 12:12 AM
From: John Fedor
Subject: 3810M AAA error after upgrade - "Access denied; maximum session limit for the user is reached."

Adding "aaa authentication login privilege-mode" actually made it worse somehow - shows that the Radius servers are approving the authentication request, but the switch keeps asking for the password like it didn't like it until fails after repeated attempts - this is for the initial SSH authentication, not the enable.

I'll see about going the TAC route.

Thanks.


------------------------------
John Fedor

Original Message:
Sent: Nov 16, 2021 07:07 AM
From: Herman Robers
Subject: 3810M AAA error after upgrade - "Access denied; maximum session limit for the user is reached."

Please open a TAC case. This may be bug 254976, which was fixed in 16.10.0013, but as you are on 16.11 it may be something different as well.

You may consider getting users in enable mode right away, by setting the aaa authentication login privilege-mode (video here) and see if that helps.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Nov 15, 2021 10:21 AM
From: John Fedor
Subject: 3810M AAA error after upgrade - "Access denied; maximum session limit for the user is reached."

We upgraded our 3810M from KB.16.10.0011 to KB.16.11.0002
prior to that, when we'd SSH into the switch, we'd authenticate via AAA server, then type in 'enable' and authenticate again (same creds).

After the upgrade, I can SSH & authenticate fine, but when I go do 'enable', and enter in creds, I get the "Access denied; maximum session limit for the user is reached." message

Even if I use a different identity for the enable than from the login, same message (in case there was some secret limit of 1)
On the Radius side, it shows it is authenticating / granting access each time.

I didn't see anything in the release notes around anything impacting aaa or radius.
I can get in by stopping the radius servers and using local accounts, but would be nice to have the AAA working properly again.

No changes to the commands done, still looks like:
aaa server-group radius "Auth1" host 192.168.5.10
aaa server-group radius "Auth1" host 192.168.5.11
aaa authentication ssh login radius server-group "Auth1" local
aaa authentication ssh enable radius server-group "Auth1" local

Wasn't finding much in the way of hits on the error message.

------------------------------
John Fedor
------------------------------

You need to add a radius attribute to NPS network policy for switch logins

Standard radius attribute
attribute type- service-type
check others bubble and select Administrative\

Once added this resolved this issue for me

James Conrad
Original Message:
Sent: Nov 15, 2021 10:21 AM
From: John Fedor
Subject: 3810M AAA error after upgrade - "Access denied; maximum session limit for the user is reached."

We upgraded our 3810M from KB.16.10.0011 to KB.16.11.0002
prior to that, when we'd SSH into the switch, we'd authenticate via AAA server, then type in 'enable' and authenticate again (same creds).

After the upgrade, I can SSH & authenticate fine, but when I go do 'enable', and enter in creds, I get the "Access denied; maximum session limit for the user is reached." message

Even if I use a different identity for the enable than from the login, same message (in case there was some secret limit of 1)
On the Radius side, it shows it is authenticating / granting access each time.

I didn't see anything in the release notes around anything impacting aaa or radius.
I can get in by stopping the radius servers and using local accounts, but would be nice to have the AAA working properly again.

No changes to the commands done, still looks like:
aaa server-group radius "Auth1" host 192.168.5.10
aaa server-group radius "Auth1" host 192.168.5.11
aaa authentication ssh login radius server-group "Auth1" local
aaa authentication ssh enable radius server-group "Auth1" local

Wasn't finding much in the way of hits on the error message.

------------------------------
John Fedor
------------------------------