Manuals / Nortel Networks / Computer Equipment / Network Router

Nortel Networks NN46110-602 manual Radius server returned access challenge

Models: NN46110-602

1 230

Download 230 pages 7.59 Kb

Page 197

Appendix C System messages 197

Action: Verify that the shared secrets match.

RADIUS: <server-name> sent packet with invalid response authenticator for <user-name>

Description: This message indicates that an invalid response was received. The computed authenticator does not match the value in the packet.

Action: Verify that the shared secrets match.

RADIUS server returned access challenge

Description: This message indicates that a valid access-challenge response was received.

Action: No action required.

RADIUS: <server-name> sent challenge for <user-name>

A valid access-challenge response was received.

Action: No action required.

RADIUS access challenge received

Description: This message is received by the VPN Client. A valid access-challenge response was received.

Action: No action required.

RADIUS server rejected access

Description: This message indicates that a valid access-reject response was received.

Action: No action required.

Nortel VPN Router Troubleshooting

Image 197

Nortel Networks NN46110-602 manual Radius server returned access challenge, Radius server-name sent challenge for user-name

Contents

Nortel VPN Router Troubleshooting Trademarks Copyright 2007 Nortel Networks. All rights reservedRestricted rights legend Statement of conditionsNortel Networks Inc. software license agreement Nortel VPN Router TroubleshootingGeneral Contents Chapter Status and logging Chapter Troubleshooting Chapter Packet capture Appendix a MIB support Appendix B Using serial PPP Index Contents NN46110-602 Figures Figures NN46110-602 Tables Tables NN46110-602 Text conventions Before you beginItalic text Acronyms L2TP Related publications Finding the latest updates on the Nortel Web site Hard-copy technical manuals How to get helpGetting help from the Nortel Web site Getting help over the phone from a Nortel Solutions CenterGetting help through a Nortel distributor or reseller New in this release FeaturesSnmp interface index enhancement Automatic backupsPcap enhancements Administrator settings Chapter VPN Router administrationVPN Router administration Tools Dynamic passwordFile management System configurationSimple Network Management Protocol Snmp VPN Router administration Admin Snmp Traps window Click Enable for User IP Address PoolTo configure the amount Chapter Status and logging Reports SessionsStatistics SystemHealth check Accounting records AccountingData collection task Radius accountingTimestamp Event log LogsEvent logs Select Status Event LogCapture and display filters Configure Display Entity Security log System logConfiguration log Shutdown Chapter Administrative tasksUsing the recovery diskette RecoveryAccessing the diskette drive Recovery Diskette window Software/backup/v101/SN01001 Administrative tasks Automatic backups Transferring backup files through Sftp Using the GUI for automatic backupTriggering a backup when a file or directory changes Select Admin Auto BackupAutomatic Backup window appears. Figure Click Configure Specific Backup To overwrite a file, click Overwrite files at destination Specific Automatic Backup windowUsing the CLI for automatic backup Backing up changes to specific files or directories Stopping the backup of specific files and directoriesBacking up specific files and directories Stopping the transfer of backup files using Sftp Using Sftp to transfer backup filesUpgrading the software Disabling new loginsSelect Admin Shutdown Click Disable new logins. Figure Checking available disk space Select Admin File SystemCreating a control tunnel to upgrade from a remote location Backing up system files Creating a recovery disketteSelect Admin Recovery and click Create Diskette Retrieving the new software Select Admin UpgradesFTP menu example Internal Radius Accounting Interim Radius Accounting Record Before completing the upgradeApplying the software After you upgrade the softwareSelect Admin Shutdown and deselect Disable new logins Administrative tasks Chapter Troubleshooting Client-based tools Troubleshooting toolsOther tools System-based toolsDiagnosing client connectivity problems Solving connectivity problemsCommon client connectivity problems Authentication failed Login not allowed at this timeRemote host not responding Maximum number of sessions reachedExtranet connection lost Other IPsec errorsNo proposal chosen Problems with name resolution using DNS services Cannot browse the network with NetBEUI Network browsing problemsTroubleshooting Diagnosing WAN link problems Check the T1/V.35 interface Check the PPP layer Check the Hdlc framingPerformance tips for configuring Microsoft networking Solving performance problemsEliminating modem errors Hardware encryption accelerator connectivityWhat should be configured on the Pptp or IPsec client? What Wins settings are recommended? Why should Wins settings be different for extranet access?What can you try on the Wins server when it is not working? Can I control which machine is the master browser? Why are subnet masks important? What should I do about subnets? Why cant I browse another client in a different tunnel? Troubleshooting Additional information Web browser problems and the VPN Client Manager Solving general problemsImproving performance with Internet Explorer Long delays when Web browsingEnabling Web browser options Clearing your Web browser cache when upgrading Web browser error messagesInternal error message Clearing cacheExcess resource consumption using Internet Explorer New administrator login ignoredDocument not found message Internet Explorer 4.0 multiple help windowsSystem problems Reporting a problem with a Web browserPower failure Distorted background imagesSelect Servers Ldap Click Stop Server Group and user profile settings not savedClient address redistribution problems Solving routing problemsAn error occurred while parsing the policy Solving firewall problemsAn error occurred while communicating with the VPN Router Action Close the Stateful Firewall ManagerUnable to communicate with the VPN Router Authorization failed. Please try againContents of the database may have changed Deselect Cache JARs in Memory System files were not loaded properlyAction Troubleshooting NN46110-602 Chapter Packet capture Pcap features File format Security featuresTunnel captures Capture typesPhysical interface captures Global IP captures Triggers Filters and triggersCapture filters Memory considerations Saving captured dataPerformance considerations Enabling packet capture on a VPN Router Serial main menu appears Enter Privileged Exec modeCapturing packets to disk file Setting the Pcap file pathSetting the maximum number of disk capture files Setting the size of the RAM bufferSetting the size of a disk capture file Creating a capture object Configuring and running packet capture objectsSaving captured data Configuring a capture object CES#capture ether0 Tunnel capture parameters Starting, stopping, and saving capture objects Using the show capture command to display capture statusCES# show capture Exit Capture Configuration mode Sample packet capture configurationsInterface capture object using a filter and direction CES#show capture test-filter-in Interface capture object using triggersCES#capture test-trigger start CES#show capture test-trigger Capture state Stopped by stop Tunnel capture object using a remote IP addressLocate the Microsoft Windows row and click local archive Installing Ethereal softwareViewing a packet capture output file on a PC Saving, downloading, and viewing Pcap files Click ethereal-setup-n.nn.n.exeGlobal IP capture Viewing a Pcap file with Sniffer ProClick Tools Options Protocol Forcing Deleting capture objects and disabling packet captureCES# no capture test-trigger Packet capture NN46110-602 Novell IPX MIB Snmp RFC supportNovell RIP-SAP MIB RFC 1850-OSPF Version 2 Management Information BaseRFC 2667-IP Tunnel MIB RFC 1724-RIP Version 2 MIB ExtensionRFC 1213-Network Management of TCP/IP-Based Internets RFC 2737-Entity MIB RFC 2787-VRRP MIBRFC 2233-If MIB RFC 1573-IanaIfType MIBRFC 2571-Snmp-Framework MIB RFC2790-Host Resources MIBRFC2495-DS1 MIB VPN Router MIB RFC2863 Interface MIB 64 bit counters supportTRAP-TYPE Cestraps.mib-Nortel proprietary MIBVariables Newoak.mib Hardware-related traps Appendix a MIB support Appendix a MIB support Appendix a MIB support Server-related traps Appendix a MIB support Software-related traps Login-related trapsSystem-related traps Intrusion-related trapsInformation passed with every trap Provides trap categories and explanations Provides descriptions for the VPN Router traps Appendix a MIB support VPN Router traps MIB descriptions Appendix a MIB support VPN Router traps MIB descriptions Attached Failed Please note that X corresponds to Is not reachable and at least one Appendix a MIB support Appendix a MIB support VPN Router traps MIB descriptions IfReasonForStatus-ces-reason for the change in status Appendix a MIB support VPN Router traps MIB descriptions That triggered this event Appendix a MIB support VPN Router traps MIB descriptions Appendix a MIB support VPN Router traps MIB descriptions That triggered this event Establishing a serial PPP connection Appendix B Using serial PPPDouble-click the Microsoft Dial-Up Networking icon Setting up a Dial-Up Networking connectionSelect System Settings Setting up the VPN RouterSetting up the modem Appendix B Using serial PPP Dialing in to the VPN Router Troubleshooting Serial PPPCause ActionsAction PPP option settings Appendix B Using serial PPP NN46110-602 Certificate messages Error removing CA certificate fileInstalled new CA certificate from file TCert task creation failed TCert X.509 certificates disabled in flash memoryTCert Shutdown complete Isakmp 13 No proposal chosen in message from xxx a.b.c.d Isakmp messagesIsakmp 13 Authentication failure in message from xxx a.b.c.d No response from client-logging out Isakmp 13 xxx a.b.c.d has exceeded idle timeout-logging outBranch office messages Couldnt install route for remxxx@xxxChecking chain invalid parent cert SSL messagesChecking chain invalid child cert Child cert xxx not valid signature by xxxDatabase messages Configuration file xxx does not existNo matching trusted CA certs Failed to startSecurity messages Ldif file could not restoreAccount xxxxxx uid xxx not found in account AuthServer ldap inconsistent no server type in entrySecurity store new system name xxx failed-xxx Conn backlog reached, possible SYN attackSecurity store new system IP address xxx failed-xxx Error copying subentries of xxx to Error copying entry xxx toError copying tree xxx to Security store new system subnet mask xxx failed-xxxError deleting tree Error deleting entrySchemaCls Database schema not available LocalAuthServer failed remove-xxxSession xxxxxx invalid uid-authentication failed Session xxx uid invalid-authentication failedXxx xxx being referenced by Session xxxxxx session rejected-system is initializingSession xxxxxxxxx AddLink failed xxx current links Session xxxxxxxxx xxx auth method not allowedSession xxxxxxxxx account is disabled Session xxxxxxxxx L2TP host xxx account misconfiguredSession xxxxxxxxx IP address assignment failed Session xxxxxxxxx account has max linksSession xxxxxxxxx connect Qos level xxx full Session xxxxxxxxx authentication failed usingSession xxxxxxxxx account not allowed now Disable logins after restart checkbox is selected Session xxxxxxxxx login rejected new logins disabledSession xxxxxxxxx no memory free xxx threshold Session xxxxxxxxx only one session/static address allowedSession xxxxxxxxx session directed to use server Session xxxxxxxxx pool address xxx already in useSession xxxxxxxxx static address xxx already in use Session xxxxxxxxx system has max sessionsRadius server-name server timed out Radius accounting messagesRadius no reply from server server-nameport number Non-matching ID in server response Radius server-name server failedIndicated packet length too large Received bad attribute type from server Unsupported response type number received from serverResponse OK Radius user-name accounting record sent to server-name OKRadius no reply from Radius server server-nameport number Radius authentication messagesLogin failure due to Server network connection failure Radius server-name server timed out authenticating user-name Non-matching id in server response Radius access challenge received Radius server returned access challengeRadius server rejected access Radius server-name sent challenge for user-nameRadius user-name access OK by server server-name Radius user-name access Denied by server server-nameOspf Disabled Routing messagesOpened OSPF-RTM connection Ospf EnabledClosing OSPF-RTM connection LoadOspfAreas Failed Can not accept x.x.x.x as router idLoadOspfIntf Failed VR xxx Starting xxx as Master forVR xxx Shutting down xxx on VR xxx Starting xxx as Backup forVR xxx Starting xxx as master delayed Backup for RIP xxx RIP Enabled Unable to get configuration for VRRIP xxx RIP Disabled RIP xxx Cant alloc main nodeRIP xxx Unable to register with UDP RIP xxx Circuit xxx deletedRIP xxx setsockopt RIP socket xxx Sorcvbuf xxx failed RIP xxx bind RIP socket xxx failedRIP xxx cid xxx mismatched auth password from RIP xxx Unable to spawn timer task xxx for RIPInterface nnn not present, deleting from config Interface nnn replaced, resetting configHWAccel nnn not present, deleting from config Interface nnn replaced, deleting from configAppendix C System messages NN46110-602 Configuring the Cisco 2514 router, Version Appendix D Configuring for interoperabilityVPN Router and Cisco 2514 network topology NN46110-602 Following is a show config command Configuring the VPN Router for Cisco interoperability Appendix D Configuring for interoperability Mask Connecting to IRE SafeNET/Soft-PK Security Policy ClientClick Pre-Shared Key 10.42SafeNet/Soft-PK Security Policy Editor dialog box appears Encapsulation Protocol ESP Configuring the VPN Router for IRE interoperabilitySA Life Seconds and 3000 Seconds Go to Profiles Networks and click EditThird-party client installation Considerations for using third-party clients Appendix D Configuring for interoperability Configuring the VPN Router as a branch office tunnel Set Perfect Forward Secrecy PFS to match the client side Configuring the VPN Router as a user tunnelTo configure the VPN Router as a user tunnel Configuring IPX IPX client Sample IPX VPN Router topology IPX group configurationWindows 95 and Windows Windows NTIPX topology Nortel VPN Router Troubleshooting Appendix D Configuring for interoperability NN46110-602 Index Index Pptp Wins