Define the Security Server—RADIUS
To specify a RADIUS server host, use the
radius-server host global configuration command. Use the no form of this
command to delete the specified RADIUS host. The syntax is
Rtr1(config)#radius-server host {hostname | ip-address} [auth-port port-num]
[acct-port port-num] [timeout seconds] [retransmit
retries] [key string]
[alias{hostname | ip-address}]
Rtr1(config)#no
radius-server host {hostname | ip-address} [auth-port port-num]
[acct-port port-num] [timeout seconds] [retransmit retries] [key string]
The following example defines port 12 as the destination port for
authentication requests and port 16 as the destination port for accounting
requests on a RADIUS host named 192.168.1.4. Because entering a line resets all
the port numbers, you must specify a host and configure both the accounting and
authentication ports on a single line.
Rtr1(config)#aaa new-model
Rtr1(config)#radius-server host 192.168.1.4 auth-port 12 acct-port 16
To use separate servers for accounting and authentication, use the
zero port value, as appropriate. The following example specifies RADIUS
server192.168.1.4 be used for accounting, but not for authentication, and RADIUS
server host1 be used for authentication, but not for accounting:
Rtr1(config)#aaa new-model
Rtr1(config)#radius-server host 192.168.1.4 auth-port 0
Rtr1(config)#radius-server host host1.domain.com acct-port 0
Define RADIUS Server Key Option
The global authentication encryption key is set with the global configuration command radius-server key.
This key value must match the key value configured on the RADIUS server, if one
is used. Use the no form of this command to disable the key. The syntax is
Rtr1(config)#radius-server key string
Rtr1(config)#no radius-server key [string]
The following example specifies a global timeout of seven seconds,
a global key of cisco-key, and then three RADIUS servers. The first—rad-serv1—is
the one all requests are sent to first. If those requests aren’t answered before
the timeout timer expires (seven seconds), the next two servers are tried in
order. The global timeout and key settings only apply to the first two servers
because the third one has overriding options defined.
Rtr1(config)#aaa new-model
Rtr1(config)#radius-server timeout 7
Rtr1(config)#radius-server key cisco-key
Rtr1(config)#radius-server host rad-serv1
Rtr1(config)#radius-server host 192.168.1.4
Rtr1(config)#radius-server host 192.168.6.4 timeout 3 key cisco9
Sections
Comments (0 posted)
Syndication
