Troubleshooting for RADIUS Authentication Failure

Contents

Objective

Requirements

Introduction

Troubleshooting Steps

Conclusion

Objective

This article briefly describes the causes of RADIUS authentication failures and the corresponding solutions.

Requirements

• RADIUS Server
• Omada Controller (software Controller / hardware Controller / CBC, v5.9 and above)
• Omada Smart, L2+ and L3 series switches

Introduction

RADIUS authentication failures are usually due to incorrect configuration. For example, the shared keys are inconsistent, or the port numbers of the server and switch are inconsistent. Follow these troubleshooting steps to resolve your issue.

The following is the typical topology of RADIUS authentication. Omada switch as the RADIUS Client, collects user information and transfers it to the RADIUS server for authentication.

When authentication fails using a RADIUS server, you can troubleshoot by following these steps.

Troubleshooting Steps

Step 1. Check whether the RADIUS Config on Omada Controller is correct. Log in to the Controller via web browser, go to Settings > Profiles > RADIUS Profile > Edit RADIUS Profile. Check whether the Authentication Server IP, Authentication Port, and Authentication Password match the RADIUS Server.

Step 2. Check whether the RADIUS server works properly. Here takes the common FreeRadius server as an example. You can start the server in debug mode (root user privileges are required) and see if the radius service program runs properly. You can check whether FreeRadius starts properly by using the following command:

radiusd –X

When you enter the command, "Ready to process requests" appears, indicating that your FreeRadius server is running properly.

Step 3. Check whether the network connection is normal and the client can access the RADIUS server. You can run the ping command on the client to check whether the RADIUS Server can be pinged through. In some network cases, clients cannot access the RADIUS server due to network isolation or firewalls.

Note: If the network uses 802.1X port access control, clients must first be authenticated before they can access network resources. In this case, the unauthenticated client cannot obtain the IP address and cannot ping through the RADIUS server.

Conclusion

You can troubleshoot RADIUS authentication failures by above steps. If the preceding steps fail to resolve the problem, collect network topology information, Controller configuration information, and RADIUS server log information to Technical Support for help.

Get to know more details of each function and configuration please go to Download Center to download the manual of your product.