Software Upgrades: Please check our latest Download section.
Search Tip: You can increase the accuracy of your searches by using as many keywords as possible. Remove any common words such as "a", "or", "the" as they will be used in the search. Do not use any operands such as +, or quotation marks to enclose phrases.
Configuring RSA ACE/Server RADIUS for the 833 servers.
Ensure that RADIUS is supported on your ACE server.
RSA Ace Server -> Configuration Management
On the Configuration Information -> Enable Features : ensure that RADIUS Server Enabled is checked.
When you start the RSA Server under Control Panel, verify that the RSA ACE/Server RADIUS Daemon is started. Check with Administrative Tools -> Services.
RSA Ace Server -> Database Administration
Adding a New Agent Host (this would be the 833 server):
Agent Host option
Add Agent Host
Name: Enter the host name of the Perle
Network Address: will be automatically resolved through DNS or Host table entry
Agent Type: Communication Server
Enable Open To All Locally Known Users if you wish all configured users to be able to authenticate. Otherwise use the User Activations button to select individual users.
Select the Assign/Change Encryption Key button and enter the Secret Key that was configured in the Perle's RADIUS configuration.
Select the Assign Acting Servers button and select the Master/Slave servers from the list that will authenticate this Agent Host.
For the 833AS/IS you must add a new Profile to permit administration of the Perle.
Name: Enter a name for the Profile
Under the Available Attributes select the Service-Type option and Add Attribute.
Select the Value of Administrative-User
Assign the administrative Profile to a user.
Edit User and select the user ID
Select the Assign Profile button
Select the Profile that was created above for the administration
You can create custom Profiles for other attributes (see Perle 833 User Guide) that can be assigned to normal users.
When dialing in using RADIUS a terminal window is not used (unlike SecurID security).
The PASSWORD used in the PPP connection will be the user's PIN and the PASSCODE from the token separated by a comma.
If you are creating a new User then you will have to manually generate a PIN as there will be no User communication to create one during the PPP connection. Refer to your RSA SecurID manual on creating PIN codes.
The RSA/Server Activity log will record events, this should always be referenced when trouble shooting.
Node Verification Failed
The Secret Key configured in the Perle and Configured in the ACE/Server are mismatched.
> Verify the key configuration.
The ACE/Server has registered a SecurID key and has not cleared it.
> In the Agent Host entry enable the Node Secret Created option to clear the Secret. Then Stop and Restart the RSA/Server RADIUS Server service.
> If this does not clear the problem then there is most likely a Registry entry for the Secret that requires to be cleared:
HKey Local Machine -> Software -> SDTI -> ACECLIENT
Agent Host Not Found
The SecurID server that is the Acting Master/Slave server is not added to the Agent Host configuration/
> Add the server indicated in the Activity Log to the Agent Host table.
Authentication fails and no messages logged in the ACE/Server Activity Log
The RSA/Server RADIUS Daemon is not started.
> Verify that the service is started, and that your Services file lists a RADIUS service running on UDP port 1645.
> Ensure that there are no other RADIUS servers running on the host, such as Windows Internet Authentication Services.
No Password was entered in the PPP dialer.
> Use your PIN,PASSCODE as the password for the dialup session.
CHAP is enabled in the Perle RADIUS security configuration.
ACE/Server RADIUS does not support CHAP.
> Reconfigure the Perle to use PAP only.
Note: as there is no terminal interaction with the ACE/Server when RADIUS authentication is used, the PIN must be preconfigured for the client and connections may fail if the authentication occurs at the same moment the Passcode expires.