Configuring The Switch For Vendor-Proprietary Radius Server Communication - Cisco Catalyst 3750 Software Configuration Manual

Controlling Switch Access with RADIUS
This example shows how to apply an output ACL in ASCII format to a port for the duration of this
connection:
cisco-avpair= "ip:outacl#2=deny ip 10.10.10.10 0.0.255.255 any"
Other vendors have their own unique vendor-IDs, options, and associated VSAs. For more information
about vendor-IDs and VSAs, refer to RFC 2138, "Remote Authentication Dial-In User Service
(RADIUS)."
Beginning in privileged EXEC mode, follow these steps to configure the switch to recognize and use
VSAs:
Command
Step 1 configure terminal
Step 2
radius-server vsa send [accounting |
authentication]
Step 3
end
Step 4
show running-config
Step 5
copy running-config startup-config
For a complete list of RADIUS attributes or more information about vendor-specific attribute 26, refer
to the "RADIUS Attributes" appendix in the Cisco IOS Security Configuration Guide for Release 12.1.

Configuring the Switch for Vendor-Proprietary RADIUS Server Communication

Although an IETF draft standard for RADIUS specifies a method for communicating vendor-proprietary
information between the switch and the RADIUS server, some vendors have extended the RADIUS
attribute set in a unique way. Cisco IOS software supports a subset of vendor-proprietary RADIUS
attributes.
As mentioned earlier, to configure RADIUS (whether vendor-proprietary or IETF draft-compliant), you
must specify the host running the RADIUS server daemon and the secret text string it shares with the
switch. You specify the RADIUS host and secret text string by using the radius-server global
configuration commands.
Beginning in privileged EXEC mode, follow these steps to specify a vendor-proprietary RADIUS server
host and a shared secret text string:
Command
Step 1 configure terminal
Step 2
radius-server host {hostname | ip-address} non-standard
Catalyst 3750 Metro Switch Software Configuration Guide
7-30
Purpose
Enter global configuration mode.
Enable the switch to recognize and use VSAs as defined by RADIUS IETF
attribute 26.
(Optional) Use the accounting keyword to limit the set of recognized
•
vendor-specific attributes to only accounting attributes.
• (Optional) Use the authentication keyword to limit the set of
recognized vendor-specific attributes to only authentication attributes.
If you enter this command without keywords, both accounting and
authentication vendor-specific attributes are used.
Return to privileged EXEC mode.
Verify your settings.
(Optional) Save your entries in the configuration file.
Purpose
Enter global configuration mode.
Specify the IP address or host name of the remote
RADIUS server host and identify that it is using a
vendor-proprietary implementation of RADIUS.
Chapter 7 Configuring Switch-Based Authentication
78-15870-01