If you're using an access-list on the vty lines you shouldn't forget to mention the vrf too:
line vty 0 4 access-class xx in vrf-also This was found on the nsp archives: http://puck.nether.net/pipermail/cisco-nsp/2004-January/007963.html -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Oliver Boehmer (oboehmer) Sent: Friday, February 29, 2008 3:29 PM To: Tord Førland; [email protected] Subject: Re: [c-nsp] AAA/RADIUS Authentication and VRF-Lite Tord Førland <> wrote on Friday, February 29, 2008 1:13 PM: > Hi guys! > > I'd like to start out by complementing this great service. I've been > a silent member for now, but it has been very interesting to read > about real-life issues. The issue I'm posting now was first posted on > NetPro, but no one ever answered, so I thought I'd pitch it to you > guys :) > > I've run into a strange problem, when using AAA Radius authentication > and VRF-Lite. > > The setting is as follows. A /31 linknet is setup between PE and CE > (7206/g1 and C1812), where PE sub-if is a part of an MPLS VPN, and CE > uses VRF-Lite to keep the local services seperated (where more than > one VPN is used..). > > Access to the CE, via telnet, console etc, will be authenticated by > our RADIUS servers, based on the following setup: > > > --> Config Begins <--- > > aaa new-model > ! > ! > aa group server radius radius-auth > server x.x.4.23 auth-port 1645 acct-port 1646 > server x.x.7.139 auth-port 1645 acct-port 1646 [...] > ip radius source-interface <outside-if> vrf 10 You need "ip vrf forwarding <name>" within the server group to tie this group to a VRF. Assigning source-interface is not enough.. Have you tried this? oli _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ ************************************************************************************ This footnote confirms that this email message has been scanned by PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses. ************************************************************************************ ************************************************************************************ This footnote confirms that this email message has been scanned by PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses. ************************************************************************************ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
