Ethernet Switches & Routers

Reply
Senior Member
Posts: 1
Registered: ‎04-28-2016

Radius attributes won't work

Dear Brocade users,

We started a project to make a central authentication platform for all of our management devices. To make it easier to manage and make it more secure.
Now I have created a test setup with OpenLDAP 2.4.41 and FreeRadius 3.0.11. This works well and now is the part to make it compatible with our equipment.


I managed to make the switch authenticate against radius, users that are allowed can login. What we want is that we have two groups a read-only and a admin group.
I found it the best way to send radius attributes to switch with the correct permissions specified. I tried a lot but I'm unable to make it work.
It seems the switch doesn't respond to the attributes. Sadly there is no way to debug it on switch (or I didn't found it).

Hopefully someone with more experience has some advice or have a working example to show me.

Thanks in advance :P



Some information about the switch and Freeradius:

Switch:
Hardware model: ICX6450-48
Version: 07.4.01T310


Running config (parts):
aaa authentication enable default local
aaa authentication login default local radius

ip address 10.0.3.175 255.255.255.0
no ip dhcp-client enable
ip default-gateway 10.0.3.1
username manager password .....
radius-server host 10.0.3.163 auth-port 1812 acct-port 1646 default

!
ip access-list standard SSH-TTY-ALLOWEDHOSTS
 permit any
!
ip access-list standard TELNET-TTY-ALLOWEDHOSTS
 permit any
!


Proof radius is sending the attributes:
(1) Sent Access-Accept Id 38 from 10.0.3.163:1812 to 10.0.3.176:1024 length 0
(1)   Service-Type = Administrative-User
(1)   Brocade-Auth-Role = "Admin"
(1)   Foundry-Privilege-Level = 32768
(1)   Foundry-Command-String = "*"
(1)   Foundry-Command-Exception-Flag = 0
(1)   Brocade-Passwd-ExpiryDate = "04/30/16"
(1)   Brocade-Passwd-WarnPeriod = "30"


Some options to that I also tried:
Brocade-Auth-Role = "admin"
Brocade-Auth-Role = "0"
Foundry-Privilege-Level = 0

I tried a lot more but not documented it all.

Both dictionary.foundry and dictionary.brocade are installed on the freeradius server.


If you need more info please let me know!

Join the Community

Get quick and easy access to valuable resource designed to help you manage your Brocade Network.

vADC is now Pulse Secure
Download FREE NVMe eBook