Invalid reply digest error Avaya ERS8600 (part 1)

So you are getting an error "Received invalid reply digest from server" when you are trying to authenticate via RADIUS on an Avaya / Nortel ERS8600.


The error is seen as follows

Trying 10.0.0.1...
Connected to 10.0.0.1.
Escape character is '^]'.

Login: user
Password: **********
Received invalid reply digest from server Login:

So there are a few ways to resolve this issue, in this post we will look at two easy methods, a third will be explained in a later post.

Now depending on the software version running on the chassis you have two options, Using Java Device Manager (JDM) which is for pre 7.0 chassis' and Enterprise Device Manager (EDM) which is for software versions 7.0 and later.

Java Device Manager (JDM)

So open up your chassis in JDM and from the top menu select Security then Control Path... and finally RADIUS... as shown in the below image.

A new window "Radius" will open and you will see the "RADIUS Global" tab.  Now click on the "RADIUS Servers" tab and you will be shown the following.

 


You can now double click in each of the SecretKey fields next to the relevant RADIUS server Address to change the key.

Click the "Apply" button once you have changed the SecretKey to the new value and you are done.

You should now be able to logon to your ERS8600.

Trying 10.0.0.1...
Connected to 10.0.0.1.
Escape character is '^]'.

Login: user
Password: **********



ERS8600:5>

Enterprise Device Manager (EDM)

So open we web session to your chassis to use EDM and from the left menu select Security then Control Path... and finally RADIUS... as shown in the below image.

 A new window "Radius" will open and you will see the "RADIUS Global" tab.  Now click on the "RADIUS Servers" tab and you will be shown the following.

 As you can see I have removed the IP address' in the "Address" and "SourceIPAddr" column.  To change a "SecretKey" you must click on the RADIUS Server entry line that you wish to change.  **Note you can click on any field within the RADIUS Server entry line, it does not have to be the "Secret Key" column.

You are now able to access the "Change SecretKey" button that was previously greyed out.  Clicking on this button will bring up the following

Now change the RADIUS SecretKey for the server that you selected.

You should now be able to logon to your ERS8600.

Trying 10.0.0.1...
Connected to 10.0.0.1.
Escape character is '^]'.

Login: user
Password: **********




ERS8600:5>

 **NOTE the EDM method can only be performed if you are using local auth or if the RADIUS keys for the "web" interface (as noted in the "used-by web" ACLI syntax) are correct.  If you are unable to logon to EDM via RADIUS then you really need to set the RADIUS key via SNMP, which we will explore in a future post.

Success!