S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
17-11
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
Chapter 17 Troubleshooting RADIUS and
Troubleshooting RADIUS and With Cisco ACS
User Cannot Access Certain Features
Symptom
User cannot access certain features.
Troubleshooting RADIUS and With Cisco ACS
To troubleshoot RADIUS and issues with Cisco ACS, follow these steps:
Step 1
Choose
Network Configuration
using Cisco ACS and view the AAA Clients table to verify that the
Cisco SAN-OS switch is configured as an AAA client on Cisco ACS.
Step 2
Choose
User Setup > User Data Configuration
to verify that the user is configured.
Step 3
View the Cisco IOS/PIX RADIUS Attributes setting for a user. Verify that the user is assigned the correct
roles in the AV-pairs. For example,
shell:roles=”network-admin”
.
Note
The Cisco IOS/PIX RADIUS Attributes field is case-sensitive. Verify that the role listed in the
AV-pair exists on the Cisco SAN-OS switch.
Step 4
If the Cisco IOS/PIX RADIUS Attributes field is not present, follow these steps:
a.
Choose
Interface > RADIUS (Cisco IOS/PIX).
b.
Check the
User
and
Group
check boxes for the cisco-av-pair option and click
Submit
.
c.
Choose
User Setup > User Data Configuration
and add the AV-pair to assign the correct role to
each user.
Step 5
Choose
System Configuration > Logging
to activate logs to look for reasons for failed authentication
attempts.
Step 6
Choose
Reports and Activity
to view the resulting logs.
Step 7
On the Cisco SAN-OS switch, use the
show radius-server
command to verify that the RADIUS server
timeout value is set to 5 seconds or greater.
Table 17-4
User Cannot Access Certain Features
Symptom
Possible Cause
Solution
User cannot access
certain features.
User is assigned incorrect role.
For RADIUS, configure the vendor-specific attributes on
the server for the role using:
Cisco-AVPair = shell:roles="
rolename1 rolename2"
.
For , configure the attribute/value pair on the
server for the role using:
roles="
rolename1 rolename2"
.
Verify that all roles are defined on the switch.
Role is not configured for appropriate
access.
See
Chapter 18, “Troubleshooting Users and Roles.”
