- [Tutor] Now let's take a look at troubleshooting radius.
Most of the principles we've looked
at for TACACS Plus troubleshooting apply here as well.
But for completion, let's look specifically
at our radius configuration output, starting
with making sure that the radius server
is correctly identified by IP address.
We can see the server configured here as radius one.
Let me highlight those lines,
so we see that's been given the name radius one
and we can also see it has an IP address
of 20.1.1.50.
So again, if we've incorrectly configured this IP address,
our radius communication will not work.
You can also try to telnet
to reach the radius port numbers used
for services just as you can with TACACS Plus
With Cisco, radius uses port 1645
by default for authentication and 1646
for accounting.
Radius also uses ports 1812
and 1813,
so your radius server might default to those.
This is a place that you'll definitely want to check
out your server settings
and make sure that if you're using a Cisco device,
your server is set to use ports 1645
and 1646
or optionally you can specify different ports
on the router itself, and you can actually see
that I've done that here in my configuration
just so that you could take a look at that.
I have configured the authentication port 1812,
and I figured the accounting port as 1813.
So just to give you a look
at how that can be done from the router side.
Now, again, that can also be changed on the server itself.
Right underneath that, we see our pre shared key.
In our case, that key is set to read password.
Again, with this pre shared key, it's important to make sure
that it's correct here and on the server itself.
If those pre shared keys don't match,
communication will fail between the router
and the radius server.
Also, just as we discussed with TACACS
if you find the user can authenticate correctly
but they can't perform any commands,
then this points to an authorization problem
that you need to look at on the radius server.
You want to make sure that on the server,
the user is authorized to execute any commands
that they might need.
Check out the server group as well
and make sure you have included the radius server
within that server group.
So here we can see our radius server group
is named Radius Group
and there is a server added
into that group called Radius One
which is the server that we previously defined
in that group, so that's good.
Next up, we want to check out the method list.
In this configuration, the console line method
is the one that specifically points
to the radius server group.
We also need to make sure
that we're using the correct service for the method list.
Remember, that we wouldn't want to use something
like .1X or PPP when using the method list
on Console or VTY lines.
We looked at that in our previous TACACS Plus video,
and that's not going to work.
The method list should match the service
for which you are creating the list as it does here.
We also want to make sure the method lists
are actually applied to the lines.
Again, if we go down in our output,
under the console lines we can see
the console line method list is tied to the console port.
So that's what we don't want to see.
That's pointing to our radius server group.
If that's not in place, then it's going to default
to local log in and we are not going
to have radius authentication taking place
on the console lines.
And again, just to reiterate
on the server itself, you want to make sure your usernames
and passwords are created.
Also, make sure that on the server
the router's IP address is correctly specified.
So not only is our router pointing
to the radius servers IP address,
the server should also be pointing
to our router and I'll point out again, as I did
in the TACACS Plus video
that we have the IP radius source-interface command
and that's going to loop back one.
We mentioned that already in the previous video
that it's best practice to set the IP address
of a loop back as the source IP address
for AAA communication.
So you want to make sure
that matches the server configuration,
so the AAA services will work for radius.
Just to wrap things up, a few debug commands
that I'll mention here.
You can say debug radius
authentication
and that will verify
the AAA radius authentication process in real time.
Again, I don't have an actual radius or TACACS server here
so I'm not going to enter that command
but I did want to make you aware of that.
Similarly, you can use
the command debug TACACS authentication
and that's going to allow you
to debug the TACACS authentication in real time.
If you want to view local authentication processes
in real time, you can say debug AAA protocol local
to perform that.
So that's a look at
how we can troubleshoot radius TACACS Plus and local AAA.