Configuring Radius on Cisco IOS Software
To configure RADIUS on your Cisco router or access server, you must complete the following steps: Step 1. Enable AAA. Use the aaa new-model global configuration command to enable AAA.
Step 2. Identify the RADIUS server. Use the radius-server host command to specify the IP address. Use the radius-server key command to specify an encryption key that will be used to encrypt all exchanges between NAS and the RADIUS server.
Step 3. Configure AAA services. Use the aaa authentication global configuration command to define method lists that use RADIUS for authentication.
Step 4. Apply the method lists to the interfaces. Use line and interface commands to apply the defined method lists to various interfaces.
If needed, you can configure authorization using the aaa authorization command to NAS. Similarly, you can configure accounting using the aaa accounting command to enable accounting for RADIUS connections.
To configure RADIUS to use the AAA security commands, you must specify the host running the RADIUS server and a secret text string that it shares with the access server. To specify a RADIUS server host and shared secret text string, use the following commands in global configuration mode:
radius-server host {hostname | ip-address] [auth-port port-number]
[acct-port port-number] [timeout seconds] [retransmit retries] [key string] [alias {hostname | ip-address]]
Table 8-3 shows the radius-server host command parameters and their description.
|
Parameter |
Description |
|
hostname | ip-address |
Name or IP address of the RADIUS server host. |
|
auth-port port-number |
(Optional) Specifies the UDP destination port for authentication requests. The default port number is 1645. |
|
acct-port port-number |
(Optional) Specifies the UDP destination port for accounting requests. The default port number is 1646. |
|
timeout seconds |
(Optional) The time interval (in seconds) that the router waits for the RADIUS server to reply before retransmitting. This setting overrides the global value of the radius-server timeout command. If no timeout value is specified, the global value is used. Enter a value in the range from 1 to 1000. |
|
retransmit retries |
(Optional) The number of times a RADIUS request is re-sent to a server if that server is not responding or responding slowly. This setting overrides the global setting of the radius-server retransmit command. |
|
key string |
(Optional) Specifies the authentication and encryption key used between the router and the RADIUS daemon running on this RADIUS server. This key overrides the global setting of the radius-server key command. If no key string is specified, the global value is used. The key is a text string that must match the encryption key used on the RADIUS server. |
|
alias |
(Optional) Allows up to eight aliases per line for any given RADIUS server. |
Multiple RADIUS hosts may be specified on the router or NAS. This increases the availability of the RADIUS during periods of high load and server failure. The following are the steps that occur in a RADIUS server failure scenario when multiple RADIUS servers are specified:
1. A new request for RADIUS transaction is performed by the router or NAS.
2. A RADIUS packet is sent to the first server in the group that is not marked dead (as per the configured deadtime). The packet is retransmitted for the configured number of retransmissions.
3. If the packet retransmits time out (as per the configured timeout), the router will transmit the packet to the next nondead server in the list and retransmit for the configured number of time.
4. Step 3 is repeated until the specified maximum number of transmissions has been made. If the end of the list is reached before the maximum number of transmissions has been reached, the router goes back to the beginning of the list and continues from there.
This scenario does not allow for multiple RADIUS servers to share transaction load because each RADIUS server is used until marked dead. To balance the load between various servers and specify the initial server for the router or access server, use the radiusserver retry method reorder command in global configuration mode.
If this command is configured, the decision about which RADIUS server to use will be as follows:
• The router or NAS maintains the status of the first server to which a transmission is sent. This server is identified as the "flagged" server. At boot time, the flagged server is the first server listed in the server group. If the flagged server is marked as dead, the next nondead server listed after the flagged server is designated for this role. If the flagged server is the last server in the list and it is marked dead, the transaction fails, and the first server on the list becomes the flagged server.
• The transmission is sent to the flagged server for the configured number of retransmissions.
• NAS then sequentially sends the transmission through the list of nondead servers in the server group until a response is received or the maximum retries (a configurable parameter) is reached.
A server is marked dead only if both of the following conditions are met:
1. The server has not responded to the configured number of retransmission. The number of retransmission is configurable via the radius-server transaction max-tries command.
2. The server has not responded to any requests for the configured period of time.
RADIUS Authentication Example
To use a RADIUS server for AAA authentication at login or PPP, AAA must be enabled. Then, specify the RADIUS server IP or host name and key.
Example 8-7 shows a sample configuration to authenticate using RADIUS.
Example 8-7. Sample Configuration Using RADIUS
|
NAS |
confi |
-g! |
# aaa new-model |
|
NAS |
confi |
-g! |
#radius-server host 192.168.100.15 |
|
NAS |
confi |
-g! |
#radius-server key ladyhawk |
|
NAS |
confi |
-g! |
#username Elvis password k0nj0 |
|
NAS |
confi |
-g! |
#aaa authentication login test group radius local |
|
NAS |
confi |
g! |
#aaa authentication ppp test if-needed group radius |
|
NAS |
confi |
g! |
#interface group-async 1 |
|
NAS |
config- |
line}#ppp authentication pap test |
|
The configuration lines in this sample RADIUS authentication configuration mean the following:
• The radius-server host command defines the IP address of the RADIUS server host.
• The radius-server key command defines the shared secret text string between NAS and the RADIUS server host.
• The aaa authentication login test group radius local command configures the router to use RADIUS for authentication at the login prompt. If RADIUS returns an error, the user is authenticated using the local database. In this example, test is the name of the method list, which specifies RADIUS and then local authentication.
• The aaa authentication ppp test if-needed group radius command configures the Cisco IOS Software to use RADIUS authentication for lines using PPP if the user has not already been authenticated. If the EXEC facility has authenticated the user, RADIUS authentication is not performed. In this example, test is the name of the method list defining RADIUS as the if-needed authentication method.
• The ppp authentication pap test command applies the test method list to the lines specified.
RADIUS Authorization Example
To use a RADIUS server for AAA authorization, AAA must be enabled. Then, specify the RADIUS server IP or host name and key. Example 8-8 shows a sample configuration to authorize using RADIUS.
Example 8-8. Sample Configuration Using RADIUS
NAS(config ft aaa new-model ffradius-server host 192.168.100.15 ffradius-server key ladyhawk ffusername Elvis password k0nj0 aaa authorization exec list group radius aaa authorization network list group radius
• The aaa authorization exec radius command sets the RADIUS information that is used for EXEC authorization, autocommands, and access lists.
• The aaa authorization network radius command sets RADIUS for network authorization, address assignment, and access lists.
Example 8-9 shows the tasks performed to direct traffic to another server in the server group.
Example 8-9. Configuring radius-server retry method reorder Command
|
Routerl |
confi |
g |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Routerl |
confi |
g |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Routerl |
confi |
g |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Routerl |
confi |
g |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Routerl |
confi |
g |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Routerl |
confi |
g |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Routerl |
ïradius-server retry method reorder ïradius-server retransmit 1 ïradius-server transaction max-tries 5 ïradius-server host 192.168.100.15 key ladyhawk1 radius-server host 192.168.100.16 key ladyhawk2 ïradius-server host 192.168.100.17 key ladyhawk3 The configuration lines in this sample radius-server retry method reorder configuration mean the following: • The reorder is configured as host 192.168.100.15 as the flagged server and the 192.168.100.16 as a second server. • If both RADIUS servers are not responding to RADIUS packets but are not marked dead yet, the transmission for the first transaction from NAS is as follows: 192.168.100.15 192.168.100.16 192.168.100.16 192.168.100.17 • If RADIUS server 192.168.100.17 responds, all transactions initiated after that point will be sent to this host. Note An additional 4 bytes of memory are required per server group. However, because most server configurations have only a small number of server groups configured, the additional 4 bytes should minimally impact performance. To improve the RADIUS response times if a server fails, use the radius-server deadtime command in global configuration mode. The following is the syntax for this command: radius-server deadtime minutes The minutes parameter is an integer between 1 and 1440. RADIUS Accounting Example Example 8-10 is the RADIUS accounting configuration using RADIUS with the AAA command set. Figure 8-2 shows this configuration. Figure 8-2. General Configuration Using RADIUS [View full size image] 3 Ll^W LTilOfimKvi Seril r. [View full size image] 3 Ll^W LTilOfimKvi Seril r. ffemole USAI 
ffemole USAI Example 8-10. Sample RADIUS Configuration ( conf ( conf conf conf conf conf conf conf conf conf (config (config config # aaa new-model #radius-server host 192.168.100.15 #radius-server key ladyhawk #username Elvis password k0nj0 #aaa authentication ppp test1 radius local #aaa authorization network default group radius local #aaa accounting network default start-stop group radius #aaa authentication login admins local #aaa authorization exec default local line)#login authentication admins #interface group-async 1 line)#ppp authentication pap test1 The last four lines in this example RADIUS AAA configuration mean the following: • The aaa authorization network radius local command is used to assign an address and other network parameters to the RADIUS user. • The aaa accounting network start-stop radius command tracks PPP usage. • The aaa authentication login admins local command defines another method list, admins, for login authentication. • The login authentication admins command applies the admins method list for login authentication from lines 1 to 8. RADIUS Configuration Testing and Troubleshooting The commands to test and troubleshoot a RADIUS configuration are similar to ones used by TACACS and AAA: • debug radius • debug radius brief • debug radius hex • debug aaa authentication • debug aaa authorization • debug aaa accounting • show accounting The debug radius command provides information related to RADIUS. Prior to Cisco IOS Software Release 12.2(11)T, the output of this command was only available in an expanded, hexadecimal string format. This format made it difficult to interpret and analyze the output. The new options for debug radius, brief and hex, offer a user-friendly ASCII format and a complete display of attribute values. Example 8-11 shows a sample output from the debug radius command. Example 8-11. Sample Output from the debug radius Command NAS#debug radius RADIUS protocol debugging is on RADIUS packet hex dump debugging is off Router# 14:51:04: RADIUS: ustruct sharecount=3 14:51:04: Radius: radius port info() success=0 radius nas port=1 14:51:04: RADIUS: Initial Transmit ISDN 0:D:23 id 0 192.168.100.64:1824, Accounting-Request, len 358
h323-incoming-conf-id=8F3A3163 B4980003 0 29BD0 14:51:04: RADIUS: Vendor, Cisco [26] 31 VT=26 TL=25 h323-call-origin=answer 14:51:04: RADIUS: Vendor, Cisco [26] 32 VT=27 TL=26 h323-call-type=Telephony 14:51:04: RADIUS: Vendor, Cisco [26] 57 VT=25 TL=51 h323-setup-time=*13:14:02.222 EST sun mar 22 2003 14:51:04: RADIUS: Vendor, Cisco [26] 46 VT=24 TL=40 h323-conf-id=8F3A3163 B4 980003 0 29BD0 14:51:04: RADIUS: Acct-Session-Id [44] 10 "00000004" 14:51:04: RADIUS: Delay-Time [41] 6 0 Example 8-12 is sample output from the debug aaa accounting command. Example 8-12. Sample Output from the debug aaa accounting Command NAS#debug aaa accounting 08:22:12: AAA/ACCT: EXEC acct start, line 10 08:22:22: AAA/ACCT: Connect start, line 10, glare 08:22:37: AAA/ACCT: Connection acct stop: task id=11 service=exec port=10 protocol=telnet address=192.168.100.17 cmd=glare bytes in=283 bytes out=84 paks in=32 paks out=41 elapsed time=12 The show accounting command enables you to display the active accountable events on the network. It provides system administrators with a quick look at what is going on, and it can help collect information in the event of a data loss on the accounting server, as shown in Example 8-13. Example 8-13. Sample Output from the show accounting Command NAS#show accounting Active Accounted actions on Interface Serial4:16, User Elvis Priv 1 Task ID 27, Network Accounting record, 00:00:13 Elapsed task id=27 timezone=EDT service=ppp mlp-links-max=4 mlp-links-current=4 protocol=ip addr=192.168.100.12 mlp-sess-id=6 Active Accounted actions on Interface Serial4:17, User Elvis Priv 1 Task ID 29, Network Accounting record, 00:00:44 Elapsed task id=29 timezone=EDT service=ppp mlp-links-max=4 mlp-links-current=4 protocol=ip addr=192.168.100.12mlp-sess-id=1 Active Accounted actions on Interface Serial4:18, User Elvis Priv 1 Task ID 17, Network Accounting record, 00:01:19 Elapsed task id=17 timezone=EDT service=ppp mlp-links-max=4 mlp-links-current=4 protocol=ip addr=192.168.100.12mlp-sess-id=1 Active Accounted actions on Interface Serial4:20, User Elvis Priv 1 Task ID 14, Network Accounting record, 00:01:03 Elapsed task id=14 timezone=EDT service=ppp mlp-links-max=4 mlp-links-current=4 mlp-sess-id=1 protocol=ip addr=192.168.100.12 Active Accounted actions on, User (not logged in) Priv C Task ID 1, Resource-management Accounting record, 04:32:21 Elapsed task id=1 timezone=EDT rm-protocol-version=1.0 service=resource-management protocol=nas-status event=nas-start reason=reload Overall Accounting Traffic Starts Stops Updates Active Drops Network 8 4 0 4 0 Connect 0 0 0 0 0 Command 0 0 0 0 0 User creates:21, frees:9, Acctinfo mallocs:15, frees:6 Users freed with accounting unaccounted for:0 Queue length:0 |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Continue reading here: Do I Know This Already Quiz Cuh
Was this article helpful?