Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Following the setup that I have for my Cisco devices, I got some basic level of functionality authenticating users that loggin to 3Com switches authenticated against a RADIUS server. Problem is that I can not get the user to obtain admin privileges. I'm using Microsoft's IAS service. According to 3Com documentation when configuring the access policy on IAS the value of 010600000003 have to be used to specify admin access level. That value have to be input in the Dial-in profile section:

010600000003 - indicates admin privileges  
010600000002 - manager  
010600000001 - monitor  
010600000000 - visitor  

Here is the configuration on the switch:

radius scheme system  
 server-type standard  
 primary authentication XXX.XXX.XXX.XXX  
 accounting optional  
 key authentication XXXXXX  
 key accounting XXXXXX  
domain system  
 scheme radius-scheme system  
local-user admin  
 service-type ssh telnet terminal  
 level 3  
local-user manager  
 service-type ssh telnet terminal  
 level 2  
local-user monitor  
 service-type ssh telnet terminal  
 level 1  

The configuration is working with the IAS server because I can check user login events with the Eventviewer tool.

Here is the output of the DISPLAY RADIUS command at the switch:

 [4500]disp radius


SchemeName  =system                           Index=0    Type=standard  
Primary Auth IP  =XXX.XXX.XXX.XXX  Port=1645   State=active  
Primary Acct IP  =        Port=1646   State=active  
Second  Auth IP  =          Port=1812   State=block  
Second  Acct IP  =          Port=1813   State=block  
Auth Server Encryption Key= XXXXXX  
Acct Server Encryption Key= XXXXXX  
Accounting method = optional  
TimeOutValue(in second)=3 RetryTimes=3 RealtimeACCT(in minute)=12  
Permitted send realtime PKT failed counts       =5  
Retry sending times of noresponse acct-stop-PKT =500  
Quiet-interval(min)                             =5  
Username format                                 =without-domain  
Data flow unit                                  =Byte  
Packet unit                                     =1  


Total 1 RADIUS scheme(s). 1 listed  

Here is the output of the DISPLAY DOMAIN and DISPLAY CONNECTION commands after users log into the switch:

[4500]display domain  
0  Domain = system  
   State = Active  
   RADIUS Scheme = system  
   Access-limit = Disable  
   Domain User Template:  
   Idle-cut = Disable  
   Self-service = Disable  
   Messenger Time = Disable  

Default Domain Name: system  
Total 1 domain(s).1 listed.  

[4500]display connection  
Index=0   ,Username=admin@system  

Index=2   ,Username=user@system  

 On Unit 1:Total 2 connections matched, 2 listed.  
 Total 2 connections matched, 2 listed.  


%Apr  2 00:23:39:957 2000 4500 SHELL/5/LOGIN:- 1 - ecajigas( in un                                 it1 logindisp radius stat  
state statistic(total=1048):  
     DEAD=1046     AuthProc=0        AuthSucc=0  
AcctStart=0         RLTSend=0         RLTWait=2  
 AcctStop=0          OnLine=2            Stop=0  

Received and Sent packets statistic:
Unit 1........................................
Sent PKT total  :4        Received PKT total:1  
Resend Times     Resend total  
1                1  
2                1  
Total            2  
RADIUS received packets statistic:  
Code= 2,Num=1       ,Err=0  
Code= 3,Num=0       ,Err=0  
Code= 5,Num=0       ,Err=0  
Code=11,Num=0       ,Err=0  

Running statistic:  
RADIUS received messages statistic:  
Normal auth request             , Num=1       , Err=0       , Succ=1  
EAP auth request                , Num=0       , Err=0       , Succ=0  
Account request                 , Num=1       , Err=0       , Succ=1  
Account off request             , Num=0       , Err=0       , Succ=0  
PKT auth timeout                , Num=0       , Err=0       , Succ=0  
PKT acct_timeout                , Num=3       , Err=1       , Succ=2  
Realtime Account timer          , Num=0       , Err=0       , Succ=0  
PKT response                    , Num=1       , Err=0       , Succ=1  
EAP reauth_request              , Num=0       , Err=0       , Succ=0  
PORTAL access                   , Num=0       , Err=0       , Succ=0  
Update ack                      , Num=0       , Err=0       , Succ=0  
PORTAL access ack               , Num=0       , Err=0       , Succ=0  
Session ctrl pkt                , Num=0       , Err=0       , Succ=0  
RADIUS sent messages statistic:  
Auth accept                     , Num=0  
Auth reject                     , Num=0  
EAP auth replying               , Num=0  
Account success                 , Num=0  
Account failure                 , Num=0  
Cut req                         , Num=0  
RecError_MSG_sum:0        SndMSG_Fail_sum :0  
Timer_Err       :0        Alloc_Mem_Err   :0  
State Mismatch  :0        Other_Error     :0  

No-response-acct-stop packet =0  
Discarded No-response-acct-stop packet for buffer overflow =0  

The other problem is that when the RADIUS server is not available I can not log in to the switch. The switch have 3 local accounts but none of them works. How can I specify the switch to use the local accounts in case that the RADIUS service is not available?

share|improve this question
up vote 1 down vote accepted

We can login to the 3coms 45 and 55's using SSH and RADIUS authentication it is a bit of a pain to setup with IAS though.

RADIUS authentication with local failover

Here is the configuration that work on SW5500.

 sysname 5500-SI
 password-control length 4
 password-control history 2
 password-control login-attempt 3 exceed lock-time 120
 super password level 3 simple password
 local-server nas-ip key 3com
 domain default enable 3comdevicelogin
 dot1x timer tx-period 10
 dot1x timer handshake-period 1024
 dot1x authentication-method eap
radius scheme system
radius scheme 3comapsc
 server-type standard
 primary authentication
 accounting optional
 key authentication radius
 user-name-format without-domain
radius scheme 3ComDeviceLogin
 server-type extended
 primary authentication
 accounting optional
 key authentication radius
 user-name-format without-domain
domain 3comdevicelogin
 scheme radius-scheme 3ComDeviceLogin local
domain apsc
 scheme radius-scheme 3comapsc
domain system
local-user admin
 service-type ssh telnet terminal
 level 3
 password-control aging 90
local-user manager
 service-type ssh telnet terminal
 level 2
local-user monitor
 service-type ssh telnet terminal
 level 1
share|improve this answer
what about the configuration at the Microsoft ISA server? – 3D1L Aug 4 '10 at 17:34
Did this configuration for the switch solve the original question? – user90767 Aug 6 '11 at 23:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.