Cisco CRS-1 - Carrier Routing System Router Configuration Manual page 37

Configuring AAA Services on Cisco IOS XR Software
Configuring Per VRF AAA
The Per VRF AAA functionality enables AAA services to be based on VPN routing and forwarding
(VRF) instances. The Provider Edge (PE) or Virtual Home Gateway (VHG) communicates directly with
the customer's RADIUS server, which is associated with the customer's VPN, without having to go
through a RADIUS proxy. Thus, ISPs can scale their VPN offerings more efficiently, because they no
longer have to use RADIUS proxies and they can provide their customers with the flexibility they
demand.
New Vendor-Specific Attributes (VSAs)
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating
vendor-specific information between the network access server and the RADIUS server by using the
vendor-specific attribute (attribute 26). Attribute 26 encapsulates vendor-specific attributes, thereby,
allowing vendors to support their own extended attributes otherwise not suitable for general use.
The Cisco IOS XR RADIUS implementation supports one vendor-specific option using the format
recommended in the specification. Cisco's vendor-ID is 9, and the supported option has vendor-type 1,
which is named "cisco-avpair " The value is a string of the following format:
"Protocol" is a value of the Cisco "protocol " attribute for a particular type of authorization. "Attribute"
and "value" are an appropriate attribute-value (AV) pair defined in the Cisco TACACS+ specification,
and "sep" is "=" for mandatory attributes and "*" for optional attributes. This definition allows the full
set of features available for TACACS+ authorization to also be used for RADIUS.
Table 3
Table 3 Supported VSAs
VSA Name
rad-serv
rad-serv-vrf
1.The RADIUS VSAs—rad-serv, rad-serv-source-if, and rad-serv-vrf—must have the prefix "aaa:" before the
VSA name.
SUMMARY STEPS
1.
2.
OL-20382-01
protocol : attribute sep value *
describes the VSAs that are now supported for Per VRF AAA.
1
for Per VRF AAA
Value
Type Description
string Indicates the IP address, key, timeout, and retransmit number of a server and the group of
the server.
The VSA syntax follows:
rad-serv=a.b.c.d [key SomeKey] [auth-port X] [acct-port Y] [retransmit V]
[timeout W].
Other than the IP address, all parameters are optional and are issued in any order. If the
optional parameters are not specified, their default values are used.
The key cannot contain any spaces; for "retransmit V," "V" can range from 1 to 100; for
"timeout W," the "W" can range from 1 to 1000.
string Specifies the name of the VRF that is used to transmit RADIUS packets. The VRF name
matches the name that was specified through the vrf command.
configure
aaa group server radius group-name
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
How to Configure AAA Services
SC-31