Configuring Settings For All Radius Servers - Cisco Catalyst 2960 Software Configuration Manual

Controlling Switch Access with RADIUS
Establishing a Session with a Router if the AAA Server is Unreachable
To configure this command, the switch must be running the LAN Base image.
Note
The aaa accounting system guarantee-first command guarantees system accounting as the first record,
which is the default condition. In some situations, users might be prevented from starting a session on
the console or terminal connection until after the system reloads, which can take more than 3 minutes.
To establish a console or Telnet session with the router if the AAA server is unreachable when the router
reloads, use the no aaa accounting system guarantee-first command.

Configuring Settings for All RADIUS Servers

Beginning in privileged EXEC mode, follow these steps to configure global communication settings
between the switch and all RADIUS servers:
Command
Step 1 configure terminal
Step 2
radius-server key string
Step 3 radius-server retransmit retries
Step 4 radius-server timeout seconds
Step 5 radius-server deadtime minutes
Step 6
end
Step 7 show running-config
Step 8 copy running-config startup-config
To return to the default setting for the retransmit, timeout, and deadtime, use the no forms of these
commands.
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
9-36
Purpose
Enter global configuration mode.
Specify the shared secret text string used between the switch and all
RADIUS servers.
Note The key is a text string that must match the encryption key used on
the RADIUS server. Leading spaces are ignored, but spaces within
and at the end of the key are used. If you use spaces in your key, do
not enclose the key in quotation marks unless the quotation marks
are part of the key.
Specify the number of times the switch sends each RADIUS request to the
server before giving up. The default is 3; the range 1 to 1000.
Specify the number of seconds a switch waits for a reply to a RADIUS
request before resending the request. The default is 5 seconds; the range is
1 to 1000.
Specify the number of minutes a RADIUS server, which is not responding
to authentication requests, to be skipped, thus avoiding the wait for the
request to timeout before trying the next configured server. The default is
0; the range is 1 to 1440 minutes.
Return to privileged EXEC mode.
Verify your settings.
(Optional) Save your entries in the configuration file.
Chapter 9 Configuring Switch-Based Authentication
OL-26520-01