Configuring Settings For All Radius Servers - Cisco Catalyst 4500 Series Configuration Manual

Chapter 44 Configuring 802.1X Port-Based Authentication

Configuring Settings for All RADIUS Servers

To configure global communication settings between the switch and all RADIUS servers, perform these
steps:
Command
Step 1
Switch# configure terminal
Step 2
Switch(config)# radius-server key
string
Step 3
Switch(config)# radius-server
retransmit retries
Step 4
Switch(config)# radius-server
timeout seconds
Step 5
Switch(config)# radius-server
deadtime minutes
Step 6
Switch(config)# end
Step 7
Switch# show running-config
Step 8
Switch# copy running-config
startup-config
To return to the default setting for the retransmit, timeout, and deadtime, use the no forms of these
commands.
Configuring the Switch to Use Vendor-Specific RADIUS Attributes
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating
vendor-specific information between the switch and the RADIUS server by using the vendor-specific
attribute (attribute 26). Vendor-specific attributes (VSAs) allow vendors to support their own extended
attributes not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific
option by using the format recommended in the specification. Cisco's vendor-ID is 9, and the supported
option has vendor-type 1, which is named cisco-avpair. The value is a string with this format:
protocol : attribute sep value *
Protocol is a value of the Cisco protocol attribute for a particular type of authorization. Attribute and
value are an appropriate attribute-value (AV) pair defined in the Cisco TACACS+ specification, and sep
is = for mandatory attributes and is * for optional attributes. The full set of features available for
TACACS+ authorization can then be used for RADIUS.
OL-25340-01
Purpose
Enters global configuration mode.
Specifies the shared secret text string used between the switch and all
RADIUS servers.
The key is a text string that must match the encryption key used on
Note
the RADIUS server. Leading spaces are ignored, but spaces within
and at the end of the key are used. If you use spaces in your key, do
not enclose the key in quotation marks unless the quotation marks
are part of the key.
Specifies the number of times the switch sends each RADIUS request to the
server before giving up. The default is 3; the range 1 to 1000.
Specifies the number of seconds a switch waits for a reply to a RADIUS
request before resending the request. The default is 5 seconds; the range is
1 to 1000.
Specifies the number of minutes a RADIUS server, which is not responding
to authentication requests, to be skipped, thus avoiding the wait for the
request to timeout before trying the next configured server. The default is
0; the range is 1 to 1440 minutes.
Returns to privileged EXEC mode.
Verifies your settings.
(Optional) Saves your entries in the configuration file.
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
Controlling Switch Access with RADIUS
44-109