Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

3725 RAS server ios12.2 asa radius to ACS5.1 question

I have a 3725 that was using tacacs for auth but that is not working with our new ACS 5.1 server so for simplicity I would like to switch to radius. The authentications pass but the dial in user gets error 738 "didn't assign an address"

My auth on the 3725 is

radius-server configure-nas

radius-server host 172.30.2.172 auth-port 1645 acct-port 1646

radius-server key ********

radius-server authorization permit missing Service-Type

aaa authentication ppp default group radius local-case
aaa authorization network default group radius
aaa accounting exec default start-stop group radius
aaa accounting network default start-stop group radius
Ant ideas would be appreciated! thanks

4 REPLIES

Re: 3725 RAS server ios12.2 asa radius to ACS5.1 question

Hi,

I think the problem is in the attributes you are sending back from ACS, not with the 3725 config.

Are your clients relying on radius assigned ip addresses ? Can you collect a debug radius to see what you are returning ?

Nicolas

New Member

Re: 3725 RAS server ios12.2 asa radius to ACS5.1 question

General OS:

  AAA Authentication debugging is on

  AAA Authorization debugging is on

  AAA Accounting debugging is on

PPP:

  PPP detailed event debugging is on

  PPP authentication debugging is on

  PPP protocol errors debugging is on

Radius protocol debugging is on

Radius protocol verbose debugging is on

Radius packet protocol debugging is on

I have turned on all the following debugging and nothing is printed to the console while dialing in. Is there a way that debugging is not sent to the console? Also how do I associate an ip pool with my device in ACS 5,1. The new acs software is rather confusing, I guess that's a given since it's a cisco product.
thanks!

New Member

Re: 3725 RAS server ios12.2 asa radius to ACS5.1 question

interface Group-Async1

ip unnumbered FastEthernet0/0

encapsulation ppp

ip tcp header-compression

no ip mroute-cache

async mode interactive

peer default ip address pool 172.30.3.0-172.30.3.150

no keepalive

no fair-queue

ppp authentication pap

group-range 65 88

!

peer default ip address pool RAS
I changed the above line to be a defined pool to no avail. Don't know if this adds any new info
thanks

New Member

Re: 3725 RAS server ios12.2 asa radius to ACS5.1 question

peer default ip address pool 172.30.3.0-172.30.3.150

I changed this to

peer default ip address pool dhcp

and it works.

thanks

460
Views
0
Helpful
4
Replies