Authorization Reject And Accounting Accept Configuration Example; Rejecting Required Attributes Configuration Example; Radius Transmit Retries - Cisco 10000-2P2-2DC Software Configuration Manual

RADIUS Transmit Retries

Authorization Reject and Accounting Accept Configuration Example

The following example shows how to configure a reject list for RADIUS authorization and configure an
accept list for RADIUS accounting. Although you cannot configure more than one accept or reject list
per server group for authorization or accounting, you can configure one list for authorization and one
list for accounting per server group.
aaa new-model
aaa authentication ppp default group radius-sg
aaa authorization network default group radius-sg
aaa group server radius radius-sg
!
radius-server host 10.1.1.1 key mykey1
radius-server attribute list usage-only
!
radius-server attribute list bad-author

Rejecting Required Attributes Configuration Example

The following example shows debug output for the debug aaa accounting command. In this example,
required attributes 44, 40, and 41 have been added to the reject list:
Router# debug aaa authorization
AAA/ACCT(6): Accounting method=radius-sg (radius)
RADIUS: attribute 44 cannot be rejected
RADIUS: attribute 61 rejected
RADIUS: attribute 31 rejected
RADIUS: attribute 40 cannot be rejected
RADIUS: attribute 41 cannot be rejected
Because debugging output is assigned high priority in the CPU process, it can render the system
Caution
unusable. For this reason, use debug commands only to troubleshoot specific problems or during
troubleshooting sessions with Cisco Systems technical support personnel. Moreover, it is best to use
debug commands during periods of lower network traffic and fewer users. Debugging during these
periods decreases the likelihood that increased debug command processing overhead will affect system
use.
RADIUS Transmit Retries
The Cisco 10000 router supports an extended RADIUS transmit retries range. Extending the range of
RADIUS transmit retries can protect against lost records if the RADIUS server goes down or
communication to it is lost.
You use the radius-server command to specify the number of times you want the router to retry
transmitting to the RADIUS server. The extended range of values is from 1 to a value higher than 17280.
The RADIUS Transmit Retries feature is described in the following topics:
•
Cisco 10000 Series Router Software Configuration Guide
16-42
server 10.1.1.1
authorization reject bad-author
accounting accept usage-only
attribute 1,40,42-43,46
attribute 22,27-28,56-59
Feature History for RADIUS Transmit Retries, page 16-43
Chapter 16 Configuring RADIUS Features
OL-2226-23