Troubleshooting

This appendix presents strategies for how to diagnose and resolve problems that may occur when you set up and use the MAX with RADIUS. This appendix contains:

RADIUS authentication problems

RADIUS accounting problems

Connect progress codes

Disconnect progress codes

RADIUS authentication problems

1. To isolate the problem to the RADIUS server, try to authenticate a user with a local
   Connection profile.

   If the Connection profile authenticates the user, you can feel certain that your RADIUS configuration is the source of the problem.

2. In the Ethernet > Mod Config > Auth menu, check the settings for these parameters:

   • Auth. You must set this parameter to RADIUS or RADIUS/LOGOUT.

   • Auth Host #n. This parameter must indicate the correct IP address of the RADIUS server.

   • Auth Port. This parameter must indicate the RADIUS daemon's authentication port as specified in the /etc/services file.

   • Auth Key. This parameter must indicate the MAX unit's password as specified in the
     /etc/raddb/clients file. If the accounting process of the daemon is running on the same server as the authentication process (rather than on a separate host), the Acct Key parameter in the Ethernet > Mod Config > Accounting must specify the same password as the Auth Key parameter.

3. Check these settings in the MAX configuration interface:

   • The Name parameter in the System profile must indicate the MAX unit's name as specified in the /etc/raddb/clients file. Verify that the IP address of the MAX can be resolved from the name.

   • In the Ethernet > Answer menu, you must set Profile Reqd=Yes.

   • If you are using PAP, CHAP, or MS-CHAP authentication of incoming PPP, MP, and MP+ calls, you must set Recv Auth to the appropriate value in the Ethernet > Answer > PPP Options menu.

   • If you want modem callers to dial into the terminal server, you must set Security=Full in the Ethernet > Mod Config > TServ Options menu.

4. Make sure that you have copied all these files into the /etc/raddb directory:

   • dictionary

   • users

   • clients

5. Verify that you are using the latest version of the Ascend RADIUS daemon.

6. Confirm that there are no syntax errors in the user profile.

7. To isolate the source of the problem, run the RADIUS daemon in debug mode by entering one of these commands:

   radiusd -x (for the flat ASCII users file)

   radiusd.dbm -x (for the DBM database)

8. Confirm whether all users are failing authentication.

   If all modem users can connect except for users on a particular platform, contact Ascend technical support for assistance.

9. If you are using the HPUX platform, problems may occur when you compile RADIUS with the proprietary compiler.

   Try to use a gcc compiler instead.

10. Keep this additional information in mind:

    • Authentication using the /etc/passwd file (with the UNIX keyword) is incompatible with CHAP. For a user dialing in with CHAP, you must specify a static password in the user profile.

    • A comma must appear at the end of every line in a user profile except the first and last lines.

    • The Default profile in the users file must be the last entry in the file.

    • You need not restart the RADIUS daemon every time you add an entry to the users file.

    • You must restart the RADIUS daemon if you modify the clients file.

    • You need only specify an attribute in a user profile when you want to change the value from its default setting.

RADIUS accounting problems

1. Make sure that the RADIUS daemon is running with the -A option enabled.

   • The -A option specifies that the RADIUS daemon creates the accounting process.

   If you are using a flat ASCII users file, start the RADIUS daemon with the -A option by entering this command:

   radiusd -A services | incr
   

   When you specify the services argument, the daemon creates the accounting process only if a line defining the UDP port to use for accounting appears in the /etc/services file. Otherwise, the daemon does not start.

   When you specify the incr argument, the daemon creates the accounting process with the UDP port specified as the accounting port in the /etc/services file. If you have not defined the port, the daemon increments the UDP port specified for radiusd and uses that port number. This action is the default when you do not specify the -A argument.

   • If you are using a DBM database, start the RADIUS daemon with the -A option by entering this command:

     radiusd.dbm -A services
     

   You must specify the services argument when you start the daemon in DBM mode.

2. Check to see that the /usr/adm/radacct directory exists.

   If it does not exist, you can perform either of these tasks:

   • Create the /usr/adm/radacct directory.

   • Use the -a option when starting the daemon, and specify a different directory in which to store accounting information.

   The accounting process in the daemon creates a file named detail in /usr/adm/radacct, or in the directory you specify using the -a option. The detail file contains accounting records.

3. In the Ethernet > Mod Config > Auth menu, make sure that Auth=RADIUS.

   Accounting is available only with RADIUS authentication. It is not available when Auth=None, TACACS, or RADIUS/LOGOUT.

4. In the Ethernet > Mod Config > Accounting menu, check the settings of these parameters:

   • Acct: You must set this parameter to RADIUS.

   • Acct Host #n. For this parameter, you must specify the IP address of the RADIUS host.

   • Acct Port. For this parameter, you must indicate the UDP port number you specified for the accounting process of the daemon in /etc/services. Or, if you used the incr keyword for the -A option when starting the daemon, you must specify the number of the UDP port for authentication services + 1.

   • Acct Key. For this parameter, you must indicate the RADIUS client password exactly as it appears in the RADIUS clients file.

   • Sess Timer. The MAX can report the number of sessions by class to a RADIUS accounting server. The Sess Timer parameter specifies the interval in seconds in which the MAX sends session reports. You can specify a number between 0 and 65535. The default value is 0 (zero), which indicates that the MAX does not send reports on session events.

Dropping duplicate from MAX, id=num

These devices can cause delays in the link between the MAX and the RADIUS server:

• An intermediate router or other communication device that stores accounting request packets

• A busy accounting server

Backoff Q full, discarding user username

• You enabled RADIUS accounting on the MAX, but not on the RADIUS server.

• You are using the Livingston server instead of the Ascend server.

Connect progress codes

• The session has ended or has failed to authenticate (Acct-Status-Type=Stop).

• The Auth parameter is not set to RADIUS/LOGOUT.

Disconnect progress codes

• The session has ended or has failed to authenticate (Acct-Status-Type=Stop).

• The Auth parameter is not set to RADIUS/LOGOUT.

Copyright © 1998, Ascend Communications, Inc. All rights reserved.