Setting The Radius Preshared Key; Setting Iterations Of The Radius Server; Defining Vendor-Specific Attributes; Vsa Format - Cisco DS-C9216I-K9 Configuration Manual

Configuring RADIUS

Setting the RADIUS Preshared Key

You need to configure the RADIUS preshared key to authenticate the switch to the RADIUS server. The
length of the key is restricted to 65 characters and can include any printable ASCII characters (white
spaces are not allowed). You can configure a global key to be used for all RADIUS server configurations
on the switch. From Fabric Manager, choose Switches > Security > Radius and click the Defaults tab
to override this global key assignment.

Setting Iterations of the RADIUS Server

By default, a switch retries a RADIUS server connection only once. This number can be configured. The
maximum is five retries per server. You can revert the retry number to its default. From Fabric Manager,
choose Switches > Security > Radius > Defaults.

Defining Vendor-Specific Attributes

The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating
vendor-specific attributes (VSAs) between the network access server and the RADIUS server. The IETF
uses attribute 26. VSAs allow vendors to support their own extended attributes that are not suitable for
general use. The Cisco RADIUS implementation supports one vendor-specific option using the format
recommended in the specification. The Cisco vendor ID is 9, and the supported option is vendor type 1,
which is named cisco-avpair. The value is a string with the following format:
protocol : attribute sep value *
where
•
•
When you use RADIUS servers to authenticate yourself to a Cisco MDS 9000 Family switch, the
RADIUS protocol directs the RADIUS server to return user attributes, like authorization information,
along with authentication results. This authorization information is specified through VSAs.

VSA Format

The following VSA protocol options are supported:
•
•
The following attributes are supported:
•
Cisco MDS 9000 Fabric Manager Switch Configuration Guide
18-6
protocol is a Cisco attribute for a particular type of authorization
sep is = for mandatory attributes and * is for optional attributes
Shell protocol—Used in Access-Accept packets to provide user profile information.
Accounting protocol—Used in Accounting-Request packets. If a value contains any white spaces,
it should be put within double quotation marks.
roles— This attribute lists all the roles to which the user belongs. The value field is a string storing
the list of group names delimited by white space. For example, if you belong to roles vsan-admin
and storage-admin, the value field would be "vsan-admin storage-admin." This subattribute is sent
in the VSA portion of the Access-Accept frames from the RADIUS server, and it can only be used
with the shell protocol value. This is an example using the roles attribute:
Cisco-AVPair = shell:roles="network-admin vsan-admin"
Chapter 18 Configuring Switch Security
OL-7753-01