Cisco ASA - Radius

unread,

Oct 21, 2016, 6:07:59 AM10/21/16

to RCDevs Security Solutions - Technical

Hi,

For some reason my ASA marks the Radius server of my OTP server constantly asa Active and Failed

---

Oct 21 11:54:41 10.0.199.1 %ASA-2-113022: AAA Marking RADIUS server 10.151.0.49 in aaa-server group CIZToken as FAILED

Oct 21 11:54:41 10.0.199.1 %ASA-2-113023: AAA Marking RADIUS server 10.151.0.49 in aaa-server group CIZToken as ACTIVE

Oct 21 11:55:20 10.0.199.1 %ASA-2-113022: AAA Marking RADIUS server 10.151.0.49 in aaa-server group CIZToken as FAILED

Oct 21 11:55:20 10.0.199.1 %ASA-2-113023: AAA Marking RADIUS server 10.151.0.49 in aaa-server group CIZToken as ACTIVE

Oct 21 11:56:14 10.0.199.1 %ASA-2-113022: AAA Marking RADIUS server 10.151.0.49 in aaa-server group CIZToken as FAILED

Oct 21 11:56:14 10.0.199.1 %ASA-2-113023: AAA Marking RADIUS server 10.151.0.49 in aaa-server group CIZToken as ACTIVE

Oct 21 11:57:16 10.0.199.1 %ASA-2-113022: AAA Marking RADIUS server 10.151.0.49 in aaa-server group CIZToken as FAILED

Oct 21 11:57:16 10.0.199.1 %ASA-2-113023: AAA Marking RADIUS server 10.151.0.49 in aaa-server group CIZToken as ACTIVE

---

But all seems to work correctly, is this a cosmetic failure, has it to do with radius authorization instead of authentication (we use both)

Has anybody got a clue?

Kind regards,

Gerrit Jan Hoogeland

Accent Automatisering

unread,

Oct 21, 2016, 6:11:08 AM10/21/16

to RCDevs Security Solutions - Technical

We do not implement RADIUS authorisation, so you can tell your ASA to not expect it.

For the rest, we need a .pcap file of what went between the two peers.

unread,

Oct 21, 2016, 6:15:11 AM10/21/16

to RCDevs Security Solutions - Technical

Hi Accounting also not implemented?

I will create the pcap file. We can I post it?

Op vrijdag 21 oktober 2016 12:11:08 UTC+2 schreef Spyridon Gouliarmis (RCDevs):

unread,

Oct 21, 2016, 6:44:06 AM10/21/16

to RCDevs Security Solutions - Technical

Indeed, neither is accounting.

Check your emails for a link to our owncloud instance.

unread,

Oct 24, 2016, 5:54:06 AM10/24/16

to RCDevs Security Solutions - Technical

The error disappears after I turn of accounting and authorisation to the OTP server, problem solved