Configuring Radius On The Switch; Radius Authentication Features In Ibm N/Os - IBM RackSwitch G8000 Application Manual

Configuring RADIUS on the Switch

RADIUS Authentication Features in IBM N/OS

64
RackSwitch G8000: Application Guide
Use the following procedure to configure Radius authentication on your switch.
1. Configure the IPv4 addresses of the Primary and Secondary RADIUS servers,
and enable RADIUS authentication.
RS G8000(config)# radius-server primary-host 10.10.1.1
RS G8000(config)# radius-server secondary-host 10.10.1.2
RS G8000(config)# radius-server enable
Note: You can use a configured loopback address as the source address so the
RADIUS server accepts requests only from the expected loopback address
block. Use the following command to specify the loopback interface:
RS G8000(config)# ip radius source-interface loopback <1-5>
2. Configure the RADIUS secret.
RS G8000(config)# radius-server primary-host 10.10.1.1 key
<1-32 character secret>
RS G8000(config)# radius-server secondary-host 10.10.1.2 key
<1-32 character secret>
3. If desired, you may change the default UDP port number used to listen to
RADIUS.
The well-known port for RADIUS is 1812.
RS G8000(config)# radius-server port <UDP port number>
4. Configure the number retry attempts for contacting the RADIUS server, and the
timeout period.
RS G8000(config)# radius-server retransmit 3
RS G8000(config)# radius-server timeout 5
N/OS supports the following RADIUS authentication features:
• Supports RADIUS client on the switch, based on the protocol definitions in RFC
2138 and RFC 2866.
• Allows RADIUS secret password up to 32 bytes and less than 16 octets.
• Supports secondary authentication server so that when the primary
authentication server is unreachable, the switch can send client authentication
requests to the secondary authentication server. Use the following command to
show the currently active RADIUS authentication server:
RS G8000# show radius-server
• Supports user-configurable RADIUS server retry and time-out values:
– Time-out value = 1-10 seconds
– Retries = 1-3
The switch will time out if it does not receive a response from the RADIUS server
in 1-3 retries. The switch will also automatically retry connecting to the RADIUS
server before it declares the server down.