I'm doing a comparison between the two switches, and I noticed there's difference in for example round trip time.
Original Message:
Sent: Aug 25, 2023 03:35 PM
From: t.antony
Subject: Aruba 2930F first time setup - RADIUS
Aruba support remoted in, and said everything looks correct. I send them my switch config file so they can test on the lab.
What puzzles me is why on the NPS logs I don't see IP of the new switch. I should see the new switch IP even if I type in the wrong password. I see the other switches there. Could this be a certificate issue?
Original Message:
Sent: Aug 25, 2023 08:14 AM
From: t.antony
Subject: Aruba 2930F first time setup - RADIUS
Thanks I have a case open with Aruba
Original Message:
Sent: Aug 25, 2023 06:16 AM
From: Herman Robers
Subject: Aruba 2930F first time setup - RADIUS
I think if you didn't get support with the switch, you can contact Aruba support for hardware issues and bugs that don't require any troubleshooting; that is not the case here. You could work with the supplier where you purchased the switch.
The captures look incomplete, and not taken on/from your Duo server. It's really hard if things don't work at all to assist further, as the problem can be in the Duo server as well, which may not even be capable or configured for RADIUS. And if the working switch does not even send RADIUS, and may be configured for LDAP, then it's a full new deployment. The video that I posted in my first response may help you as it shows how it works with ClearPass. If Duo does RADIUS, and you want to configure it the same, you should just translate what is configured in ClearPass to something you configure in Duo.
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
Original Message:
Sent: Aug 24, 2023 09:38 AM
From: t.antony
Subject: Aruba 2930F first time setup - RADIUS
Thanks, this is a new switch, does Aruba offer free support for that?
I don't see RADIUS for the 10.0.0.8 switch either and that I can login. May be its setup to use CLDAP and that's why I'm seeing that.
Original Message:
Sent: Aug 24, 2023 09:18 AM
From: Herman Robers
Subject: Aruba 2930F first time setup - RADIUS
I can't see any RADIUS traffic in those captures. I'm seeing Kerberos, LDAP, and in the second screenshot Syslog traffic. And that syslog traffic to a system 10.0.0.20 is the log messages, so it's not RADIUS traffic or related to RADIUS. That should look like:
If you are unfamiliar with this type of deployments, it may be best to get some help from your Aruba partner or Aruba Support.
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
Original Message:
Sent: Aug 24, 2023 08:32 AM
From: t.antony
Subject: Aruba 2930F first time setup - RADIUS
Thanks for helping out, really appreciate it.
10.0.0.8 switch RADIUS works
10.0.0.9, RADIUS doesn't work.
10.0.0.15 is my DC
10.0.0.17 is Duo server
10.0.0.20 is the logging server
I did a wireshark capture on a switch that RADIUS works and this switch. On wireshark, I'm getting the same out put for both switches, so that tells me the new switch is also reaching Duo server (10.0.0.17)
When I did a wireshark capture from both switches to the DC, 10.0.0.15, the existing switch is flagging no errors, but the new switch is flagging the errors boxed in Red. Can't reach radius server 10.0.0.17, and invalid username or password on SSH. I'm using the same username and password (AD) to login to both switches, but the same username and password works on 10.0.0.8, but not on the new 10.0.0.9. I assume it says can't reach RADIUS server 10.0.0.17 because the DC 10.0.0.15 is not allowing it due to invalid username / password. Because I can ping it, so its clearly reachable.
The RADIUS keys and other stuff on 10.0.0.9, I copied it from the config of 10.0.0.8, so they all should be correct. Both switches are Aruba 2930F family. 10.0.0.8 was already setup before I came to this company, 10.0.0.9 is the new Aruba switch I'm setting up that's why I copied the RADIUS config from the other switch. This is also my first time setting up a brand new Aruba switch and also first time setting up RADIUS auth. I'm used to Netgear.
Also when I SSH to 10.0.0.8 switch (and other existing switches) from putty, it takes couple of seconds for Putty to show login as:
But this new switch, when I SSH, I immediately get the login as: prompt, so I don't know if its some kind of timing issue?
Just something I observed, but not even might be the issue.
Original Message:
Sent: Aug 24, 2023 03:38 AM
From: frmeunier
Subject: Aruba 2930F first time setup - RADIUS
Hi
I shall propose to adopt the following syntax :
aaa authentication console login radius server-group "mgmt" localaaa authentication telnet login radius server-group "mgmt" localaaa authentication web login radius server-group "mgmt" localaaa authentication ssh login radius server-group "mgmt" local
The switch succeeds in pinging the radius server's IP, so let's focus on the protocol side.
You confirm that 10.0.0.17 is successfully serving other switches ?
------------------------------
Frederic MEUNIER
Original Message:
Sent: Aug 23, 2023 12:37 PM
From: t.antony
Subject: Aruba 2930F first time setup - RADIUS
Thanks everyone,
I changed the radius key so its not public here.
10.0.0.15 & 16 are the 2 domain controllers (AD). I have IP of the new switch (10.0.0.9) added as a new client on NPS since existing switch IPs were there also.
10.0.0.17 is the Duo server. I have the IP of the new switch (10.0.0.9) added in the config file, just like the other switches that were already there.
Running configuration:; JL262A Configuration Editor; Created on release #WC.16.11.0012; Ver #14:67.6f.f8.1d.9b.3f.bf.bb.ef.7c.59.fc.6b.fb.9f.fc.ff.ff.37.ef:44hostname "Core-switch"module 1 type jl262abanner motd "#######################################################################\n# Authorized Users Only #\n# The information on this computer and network is the property of #\n# company and is protected by intellectual property #\n# rights. You must be assigned an account on this computer to #\n# access the information and are only allowed to access information as #\n# defined by the System Administrator(s). Your activities are #\n# monitored for security reasons. #\n########################################################################"logging 10.0.0.20radius-server host 10.0.0.15radius-server host 10.0.0.16radius-server host 10.0.0.17 key "key"radius-server key "radiuskey"timesync ntpntp unicastntp server 10.0.0.5ntp enableno telnet-servertime daylight-time-rule continental-us-and-canadatime timezone -300web-management sslip default-gateway 10.0.0.5interface 49 name "Uplink" exitsnmp-server community "companySNMP" operatorsnmp-server contact "company IT" location "Office"aaa server-group radius "8021x" host 10.0.0.15aaa server-group radius "8021x" host 10.0.0.16aaa server-group radius "mgmt" host 10.0.0.17aaa authentication login privilege-modeaaa authentication console login peap-mschapv2 server-group "mgmt" localaaa authentication telnet login peap-mschapv2 server-group "mgmt" localaaa authentication web login peap-mschapv2 server-group "mgmt" localaaa authentication ssh login peap-mschapv2 server-group "mgmt" localaaa authentication port-access eap-radius server-group "8021x"aaa port-access authenticator activevlan 1 name "DEFAULT_VLAN" untagged 1-48,50-52 tagged 49 ip address 10.0.0.9 255.255.255.0 exitvlan 4 name "CNC Wireless" tagged 49 no ip address exitvlan 5 name "CMM" tagged 49 no ip address exitvlan 100 name "Voice" tagged 49 no ip address voice exitvlan 302 name "Wireless" tagged 49 no ip address exitno tftp serverno autorunno dhcp config-file-updateno dhcp image-file-updateno dhcp tr69-acs-urlpassword managerpassword operator
Original Message:
Sent: Aug 23, 2023 11:32 AM
From: frmeunier
Subject: Aruba 2930F first time setup - RADIUS
Is it possible for you to paste the configuration sections (just mask the keys and other sensitive data) ?
Original Message:
Sent: Aug 22, 2023 01:41 PM
From: t.antony
Subject: Aruba 2930F first time setup - RADIUS
I got a new 2930F switch, and I have everything setup except for RADIUS. I copied the RADIUS server, keys etc. from an existing switch configuration where I'm able to login via my AD login. I also added the new switch IP on NPS, and also added new switch IP on the Duo config file.
I'm not able to figure out why only the local Manager account works, but not RADUIS.
Please see this link for more details. https://community.spiceworks.com/topic/2492432-aruba-switch-question?page=1#entry-10415826