Wired Intelligent Edge

This is a strange one. We have a 6300M switch with ClearPass as the RADIUS server. When attempting to issue a CoA disconnect, using the system-define profile in ClearPass, it fails. A packet capture reveals that the switch is sending back a NAK because of Invalid Request (see pic). The dynamic authorization client is defined on the switch and is using the same shared secret as the RADIUS server. The ClearPass NAD device definition  has dynamic authZ enabled for udp/3799 (default). Any ideas why the switch would be sending back the Invalid-Request?

This is what is being sent back from ClearPass:

This is a strange one. We have a 6300M switch with ClearPass as the RADIUS server. When attempting to issue a CoA disconnect, using the system-define profile in ClearPass, it fails. A packet capture reveals that the switch is sending back a NAK because of Invalid Request (see pic). The dynamic authorization client is defined on the switch and is using the same shared secret as the RADIUS server. The ClearPass NAD device definition  has dynamic authZ enabled for udp/3799 (default). Any ideas why the switch would be sending back the Invalid-Request?

I have seen this issue before <Duplicate Request>.

I suppose this is happening because it could be that either User-name being sent in a different format or maybe Calling Station ID Information.

I had a similar case with Cisco Switches. It happened that i had to modify the Cisco Enforcement Profile Template parameters to fix it.

This is what is being sent back from ClearPass:

This is a strange one. We have a 6300M switch with ClearPass as the RADIUS server. When attempting to issue a CoA disconnect, using the system-define profile in ClearPass, it fails. A packet capture reveals that the switch is sending back a NAK because of Invalid Request (see pic). The dynamic authorization client is defined on the switch and is using the same shared secret as the RADIUS server. The ClearPass NAD device definition  has dynamic authZ enabled for udp/3799 (default). Any ideas why the switch would be sending back the Invalid-Request?

This is Aruba to Aruba. Shouldn't this work out of the box?

I have seen this issue before <Duplicate Request>.

I suppose this is happening because it could be that either User-name being sent in a different format or maybe Calling Station ID Information.

I had a similar case with Cisco Switches. It happened that i had to modify the Cisco Enforcement Profile Template parameters to fix it.

This is what is being sent back from ClearPass:

This is a strange one. We have a 6300M switch with ClearPass as the RADIUS server. When attempting to issue a CoA disconnect, using the system-define profile in ClearPass, it fails. A packet capture reveals that the switch is sending back a NAK because of Invalid Request (see pic). The dynamic authorization client is defined on the switch and is using the same shared secret as the RADIUS server. The ClearPass NAD device definition  has dynamic authZ enabled for udp/3799 (default). Any ideas why the switch would be sending back the Invalid-Request?

It normally works out of the box. Few things that I have seen are clock differences between ClearPass and the switch, and time should be in sync to prevent replay attacks; and if you have virtual IPs on ClearPass, the CoA may come from the VIP or sometimes from the system IP, and the switch must be configured to accept from other IPs. I would check the logs on the switch, as it probably shows the reason that the switch sends a NAK. If nothing is in the standard logs, debug logging may show more details.

This is Aruba to Aruba. Shouldn't this work out of the box?

I have seen this issue before <Duplicate Request>.

I suppose this is happening because it could be that either User-name being sent in a different format or maybe Calling Station ID Information.

I had a similar case with Cisco Switches. It happened that i had to modify the Cisco Enforcement Profile Template parameters to fix it.

This is what is being sent back from ClearPass:

This is a strange one. We have a 6300M switch with ClearPass as the RADIUS server. When attempting to issue a CoA disconnect, using the system-define profile in ClearPass, it fails. A packet capture reveals that the switch is sending back a NAK because of Invalid Request (see pic). The dynamic authorization client is defined on the switch and is using the same shared secret as the RADIUS server. The ClearPass NAD device definition  has dynamic authZ enabled for udp/3799 (default). Any ideas why the switch would be sending back the Invalid-Request?

Thanks Herman. Time is definitely in sync, as they are both using the same NTP servers. We are using a VIP, but all physical IPs and the VIP are configured as RADIUS dynamic-authZ servers on the switch. Nothing stands out in the logs. I do have a TAC case open, but so far we haven't gotten far with them.

It normally works out of the box. Few things that I have seen are clock differences between ClearPass and the switch, and time should be in sync to prevent replay attacks; and if you have virtual IPs on ClearPass, the CoA may come from the VIP or sometimes from the system IP, and the switch must be configured to accept from other IPs. I would check the logs on the switch, as it probably shows the reason that the switch sends a NAK. If nothing is in the standard logs, debug logging may show more details.

This is Aruba to Aruba. Shouldn't this work out of the box?

I have seen this issue before <Duplicate Request>.

I suppose this is happening because it could be that either User-name being sent in a different format or maybe Calling Station ID Information.

I had a similar case with Cisco Switches. It happened that i had to modify the Cisco Enforcement Profile Template parameters to fix it.

This is what is being sent back from ClearPass:

This is a strange one. We have a 6300M switch with ClearPass as the RADIUS server. When attempting to issue a CoA disconnect, using the system-define profile in ClearPass, it fails. A packet capture reveals that the switch is sending back a NAK because of Invalid Request (see pic). The dynamic authorization client is defined on the switch and is using the same shared secret as the RADIUS server. The ClearPass NAD device definition  has dynamic authZ enabled for udp/3799 (default). Any ideas why the switch would be sending back the Invalid-Request?