Configuring RADIUS: in This Chapter
Configuring RADIUS: in This Chapter
This chapter describes the Remote Authentication Dial-In User Service (RADIUS) security system,
defines its operation, and identifies appropriate and inappropriate network environments for using
RADIUS technology. The “RADIUS Configuration Task List” section describes how to configure
RADIUS with the authentication, authorization, and accounting (AAA) command set.
For a complete description of the RADIUS commands used in this chapter, refer to the chapter “RADIUS
Commands” in the Cisco IOS Security Command Reference. To locate documentation of other
commands that appear in this chapter, use the command reference master index or search online.
To identify the hardware platform or software image information associated with a feature, use the
Feature Navigator on Cisco.com to search for information about the feature or refer to the software
release notes for a specific release. For more information, see the “Identifying Supported Platforms”
section in the “Using Cisco IOS Software” chapter.
In This Chapter
This chapter includes the following sections:
• About RADIUS
• RADIUS Operation
• RADIUS Configuration Task List
• Monitoring and Maintaining RADIUS
• RADIUS Attributes
• RADIUS Configuration Examples
About RADIUS
RADIUS is a distributed client/server system that secures networks against unauthorized access. In the
Cisco implementation, RADIUS clients run on Cisco routers and send authentication requests to a
central RADIUS server that contains all user authentication and network service access information.
RADIUS is a fully open protocol, distributed in source code format, that can be modified to work with
any security system currently available on the market.
Cisco supports RADIUS under its AAA security paradigm. RADIUS can be used with other AAA
security protocols, such as TACACS+, Kerberos, and local username lookup. RADIUS is supported on
all Cisco platforms, but some RADIUS-supported features run only on specified platforms.
RADIUS has been implemented in a variety of network environments that require high levels of security
while maintaining network access for remote users.
Use RADIUS in the following network environments that require access security:
• Networks with multiple-vendor access servers, each supporting RADIUS. For example, access
servers from several vendors use a single RADIUS server-based security database. In an IP-based
network with multiple vendors’ access servers, dial-in users are authenticated through a RADIUS
server that has been customized to work with the Kerberos security system.
• Turnkey network security environments in which applications support the RADIUS protocol, such
as in an access environment that uses a “smart card” access control system. In one case, RADIUS
has been used with Enigma’s security cards to validate users and grant access to network resources.
• Networks already using RADIUS. You can add a Cisco router with RADIUS to the network. This
might be the first step when you make a transition to a Terminal Access Controller Access Control
System Plus (TACACS+) server.
• Networks in which a user must only access a single service. Using RADIUS, you can control user
access to a single host, to a single utility such as Telnet, or to a single protocol such as Point-to-Point
Protocol (PPP). For example, when a user logs in, RADIUS identifies this user as having
authorization to run PPP using IP address 10.2.3.4 and the defined access list is started.
• Networks that require resource accounting. You can use RADIUS accounting independent of
RADIUS authentication or authorization. The RADIUS accounting functions allow data to be sent
at the start and end of services, indicating the amount of resources (such as time, packets, bytes, and
so on) used during the session. An Internet service provider (ISP) might use a freeware-based
version of RADIUS access control and accounting software to meet special security and billing
needs.
• Networks that wish to support preauthentication. Using the RADIUS server in your network, you
can configure AAA preauthentication and set up the preauthentication profiles. Preauthentication
enables service providers to better manage ports using their existing RADIUS solutions, and to
efficiently manage the use of shared resources to offer differing service-level agreements.
RADIUS is not suitable in the following network security situations:
• Multiprotocol access environments. RADIUS does not support the following protocols:
– AppleTalk Remote Access (ARA)
– NetBIOS Frame Control Protocol (NBFCP)
– NetWare Asynchronous Services Interface (NASI)
– X.25 PAD connections
• Router-to-router situations. RADIUS does not provide two-way authentication. RADIUS can be
used to authenticate from one router to a non-Cisco router if the non-Cisco router requires RADIUS
authentication.
• Networks using a variety of services. RADIUS generally binds a user to one service model.
RADIUS Operation
When a user attempts to log in and authenticate to an access server using RADIUS, the following steps
occur:
1. The user is prompted for and enters a username and password.
2. The username and encrypted password are sent over the network to the RADIUS server.
3. The user receives one of the following responses from the RADIUS server:
a. ACCEPT—The user is authenticated.
b. REJECT—The user is not authenticated and is prompted to reenter the username and password,
or access is denied.
c. CHALLENGE—A challenge is issued by the RADIUS server. The challenge collects additional
data from the user.
d. CHANGE PASSWORD—A request is issued by the RADIUS server, asking the user to select
a new password.
The ACCEPT or REJECT response is bundled with additional data that is used for EXEC or network
authorization. You must first complete RADIUS authentication before using RADIUS authorization.
The additional data included with the ACCEPT or REJECT packets consists of the following:
• Services that the user can access, including Telnet, rlogin, or local-area transport (LAT) connections,
and PPP, Serial Line Internet Protocol (SLIP), or EXEC services.
• Connection parameters, including the host or client IP address, access list, and user timeouts.
This section describes how to set up RADIUS for authentication, authorization, and accounting on your
network, and includes the following sections:
• Configuring Router to RADIUS Server Communication (Required)
• Configuring Router to Use Vendor-Specific RADIUS Attributes (Optional)
• Configuring Router for Vendor-Proprietary RADIUS Server Communication (Optional)
• Configuring Router to Query RADIUS Server for Static Routes and IP Addresses (Optional)
• Configuring Router to Expand Network Access Server Port Information (Optional)
• Configuring AAA Server Groups (Optional)
• Configuring AAA Server Groups with Deadtime (Optional)
• Configuring AAA DNIS Authentication
• Configuring AAA Server Group Selection Based on DNIS (Optional)
• Configuring AAA Preauthentication
• Configuring a Guard Timer
• Specifying RADIUS Authentication
• Specifying RADIUS Authorization (Optional)
• Specifying RADIUS Accounting (Optional)
• Configuring RADIUS Login-IP-Host (Optional)
• Configuring RADIUS Prompt (Optional)
• Configuring Suffix and Password in RADIUS Access Requests (Optional)
For RADIUS configuration examples using the commands in this chapter, refer to the section “RADIUS
Configuration Examples” at the end of this chapter.
example, if the first host entry fails to provide accounting services, the network access server will try the
second host entry configured on the same device for accounting services. (The RADIUS host entries will
be tried in the order they are configured.)
A RADIUS server and a Cisco router use a shared secret text string to encrypt passwords and exchange
responses.To configure RADIUS to use the AAA security commands, you must specify the host running
the RADIUS server daemon and a secret text (key) string that it shares with the router.
The timeout, retransmission, and encryption key values are configurable globally for all RADIUS
servers, on a per-server basis, or in some combination of global and per-server settings. To apply these
settings globally to all RADIUS servers communicating with the router, use the three unique global
commands: radius-server timeout, radius-server retransmit, and radius-server key. To apply these
values on a specific RADIUS server, use the radius-server host command.
Note You can configure both global and per-server timeout, retransmission, and key value commands
simultaneously on the same Cisco network access server. If both global and per-server functions are
configured on a router, the per-server timer, retransmission, and key value commands override global
timer, retransmission, and key value commands.
To configure per-server RADIUS server communication, use the following command in global
configuration mode:
Command Purpose
Router(config)# radius-server host {hostname | Specifies the IP address or host name of the remote RADIUS
ip-address} [auth-port port-number] [acct-port server host and assign authentication and accounting destination
port-number] [timeout seconds] [retransmit
retries] [key string] [alias {hostname |
port numbers. Use the auth-port port-number option to configure
ip address}] a specific UDP port on this RADIUS server to be used solely for
authentication. Use the acct-port port-number option to
configure a specific UDP port on this RADIUS server to be used
solely for accounting. Use the alias keyword to configure up to
eight multiple IP addresses for use when referring to RADIUS
servers.
To configure the network access server to recognize more than
one host entry associated with a single IP address, simply repeat
this command as many times as necessary, making sure that each
UDP port number is different. Set the timeout, retransmit, and
encryption key values to use with the specific RADIUS host.
If no timeout is set, the global value is used; otherwise, enter a
value in the range 1 to 1000. If no retransmit value is set, the
global value is used; otherwise enter a value in the range 1 to
1000. If no key string is specified, the global value is used.
Note The key is a text string that must match the encryption key
used on the RADIUS server. Always configure the key as
the last item in the radius-server host command syntax
because the leading spaces are ignored, but spaces within
and at the end of the key are used. If you use spaces in
your key, do not enclose the key in quotation marks unless
the quotation marks themselves are part of the key.
To configure global communication settings between the router and a RADIUS server, use the following
radius-server commands in global configuration mode:
Command Purpose
Step 1 Router(config)# radius-server key {0 string | 7 Specifies the shared secret text string used between
string | string} the router and a RADIUS server. Use the 0 line option
to configure an unencrypted shared secret. Use the
7 line option to configure an encrypted shared secret.
Step 2 Router(config)# radius-server retransmit retries Specifies how many times the router transmits each
RADIUS request to the server before giving up (the
default is 3).
Step 3 Router(config)# radius-server timeout seconds Specifies for how many seconds a router waits for a
reply to a RADIUS request before retransmitting the
request.
Step 4 Router(config)# radius-server deadtime minutes Specifies for how many minutes a RADIUS server
that is not responding to authentication requests is
passed over by requests for RADIUS authentication.
“Protocol” is a value of the Cisco “protocol” attribute for a particular type of authorization; protocols
that can be used include IP, IPX, VPDN, VOIP, SHELL, RSVP, SIP, AIRNET, OUTBOUND. “Attribute”
and “value” are an appropriate attribute-value (AV) pair defined in the Cisco TACACS+ specification,
and “sep” is “=” for mandatory attributes and “*” for optional attributes. This allows the full set of
features available for TACACS+ authorization to also be used for RADIUS.
For example, the following AV pair causes Cisco’s “multiple named ip address pools” feature to be
activated during IP authorization (during PPP’s IPCP address assignment):
cisco-avpair= ”ip:addr-pool=first“
If you insert an “*”, the AV pair “ip:addr-pool=first” becomes optional. Note that any AV pair can be
made optional.
cisco-avpair= ”ip:addr-pool*first“
The following example shows how to cause a user logging in from a network access server to have
immediate access to EXEC commands:
cisco-avpair= ”shell:priv-lvl=15“
Other vendors have their own unique vendor-IDs, options, and associated VSAs. For more information
about vendor-IDs and VSAs, refer to RFC 2138, Remote Authentication Dial-In User Service
(RADIUS).
To configure the network access server to recognize and use VSAs, use the following command in global
configuration mode:
Command Purpose
Router(config)# radius-server vsa send Enables the network access server to recognize and use VSAs as
[accounting | authentication] defined by RADIUS IETF attribute 26.
For a complete list of RADIUS attributes or more information about vendor-specific attribute 26, refer
to the appendix “RADIUS Attributes.”
Command Purpose
Step 1 Router(config)# radius-server host Specifies the IP address or host name of the remote
{hostname | ip-address} non-standard RADIUS server host and identifies that it is using a
vendor-proprietary implementation of RADIUS.
Step 2 Router(config)# radius-server key {0 string | Specifies the shared secret text string used between
7 string | string} the router and the vendor-proprietary RADIUS
server. The router and the RADIUS server use this
text string to encrypt passwords and exchange
responses.
Configuring Router to Query RADIUS Server for Static Routes and IP Addresses
Some vendor-proprietary implementations of RADIUS let the user define static routes and IP pool
definitions on the RADIUS server instead of on each individual network access server in the network.
Each network access server then queries the RADIUS server for static route and IP pool information.
To have the Cisco router or access server query the RADIUS server for static routes and IP pool
definitions when the device first starts up, use the following command in global configuration mode:
Command Purpose
Router(config)# radius-server configure-nas Tells the Cisco router or access server to query the RADIUS
server for the static routes and IP pool definitions used throughout
its domain.
Note Because the radius-server configure-nas command is performed when the Cisco router starts up, it
will not take effect until you issue a copy system:running config nvram:startup-config command.
Command Purpose
Router(config)# radius-server attribute nas-port Expands the size of the NAS-Port attribute from 16 to 32 bits to
format display extended interface information.
Note This command replaces the radius-server extended-portnames command and the radius-server
attribute nas-port extended command.
On platforms with multiple interfaces (ports) per slot, the Cisco RADIUS implementation will not
provide a unique NAS-Port attribute that permits distinguishing between the interfaces. For example, if
a dual PRI interface is in slot 1, calls on both Serial1/0:1 and Serial1/1:1 will appear as
NAS-Port = 20101.
Once again, this is because of the 16-bit field size limitation associated with RADIUS IETF NAS-Port
attribute. In this case, the solution is to replace the NAS-Port attribute with a vendor-specific attribute
(RADIUS IETF attribute 26). Cisco's vendor-ID is 9, and the Cisco-NAS-Port attribute is subtype 2.
Vendor-specific attributes (VSAs) can be turned on by entering the radius-server vsa send command.
The port information in this attribute is provided and configured using the aaa nas port extended
command.
To replace the NAS-Port attribute with RADIUS IETF attribute 26 and to display extended field
information, use the following commands in global configuration mode:
Command Purpose
Step 1 Router(config)# radius-server vsa send Enables the network access server to recognize and
[accounting | authentication] use vendor-specific attributes as defined by RADIUS
IETF attribute 26.
Step 2 Router(config)# aaa nas port extended Expands the size of the VSA NAS-Port field from 16
to 32 bits to display extended interface information.
The standard NAS-Port attribute (RADIUS IETF attribute 5) will continue to be sent. If you do not want
this information to be sent, you can suppress it by using the no radius-server attribute nas-port
command. When this command is configured, the standard NAS-Port attribute will no longer be sent.
For a complete list of RADIUS attributes, refer to the appendix “RADIUS Attributes.”
For information about configuring RADIUS port identification for PPP, see the Cisco IOS Wide-Area
Networking Configuration Guide.
To define a server host with a server group name, enter the following commands in global configuration
mode. The listed server must exist in global configuration mode:
Command Purpose
Step 1 Router(config)# radius-server host Specifies and defines the IP address of the server host
{hostname | ip-address} [auth-port port-number] before configuring the AAA server-group. Refer to
[acct-port port-number] [timeout seconds]
[retransmit retries] [key string] [alias {hostname |
the section “Configuring Router to RADIUS Server
ip address}] Communication” of this chapter for more information
on the radius-server host command.
Step 2 Router(config-if)# aaa group server Defines the AAA server group with a group name. All
{radius | tacacs+} group-name members of a group must be the same type; that is,
RADIUS or TACACS+. This command puts the
router in server group subconfiguration mode.
Step 3 Router(config-sg)# server ip-address Associates a particular RADIUS server with the
[auth-port port-number] [acct-port port-number] defined server group. Each security server is
identified by its IP address and UDP port number.
Repeat this step for each RADIUS server in the AAA
server group.
Note Each server in the group must be defined
previously using the radius-server host
command.
Note Since one server has different timers and may have different deadtime values configured in the server
groups, the same server may in the future have different states (dead and alive) at the same time.
Note To change the state of a server, you must start and stop all configured timers in all server groups.
The size of the server group will be slightly increased because of the addition of new timers and the
deadtime attribute. The overall impact of the structure depends on the number and size of the server
groups and how the servers are shared among server groups in a specific configuration.
To configure deadtime within a server group, use the following commands beginning in global
configuration mode:
Command Purpose
Step 1 Router(config)# aaa group server radius group1 Defines a RADIUS type server group.
Step 2 Router(config-sg)# deadtime 1 Configures and defines deadtime value in minutes.
Note Local server group deadtime will override
the global configuration. If omitted from
the local server group configuration, the
value will be inherited from the master
list.
Command Purpose
Step 1 Router# config term Enters global configuration mode.
Step 2 Router(config)# aaa preauth Enters AAA preauthentication mode.
Step 3 Router(config-preauth)# group {radius | tacacs+ | (Optional) Selects the security server to
server-group} use for AAA preauthentication requests.
The default is RADIUS.
Step 4 Router(config-preauth)# dnis [password string] Enables preauthentication using DNIS
and optionally specifies a password to
use in Access-Request packets.
Cisco routers with either ISDN or internal modems can receive the DNIS number. This functionality
allows users to assign different RADIUS server groups for different customers (that is, different
RADIUS servers for different DNIS numbers). Additionally, using server groups you can specify the
same server group for AAA services or a separate server group for each AAA service.
Cisco IOS software provides the flexibility to implement authentication and accounting services in
several ways:
• Globally—AAA services are defined using global configuration access list commands and applied
in general to all interfaces on a specific network access server.
• Per Interface—AAA services are defined using interface configuration commands and applied
specifically to the interface being configured on a specific network access server.
• DNIS mapping—You can use DNIS to specify an AAA server to supply AAA services.
Because each of these AAA configuration methods can be configured simultaneously, Cisco has
established an order of precedence to determine which server or groups of servers provide AAA services.
The order of precedence is as follows:
• Per DNIS—If you configure the network access server to use DNIS to identify/determine which
server group provides AAA services, then this method takes precedence over any additional AAA
selection method.
• Per interface—If you configure the network access server per interface to use access lists to
determine how a server provides AAA services, this method takes precedence over any global
configuration AAA access lists.
• Globally—If you configure the network access server by using global AAA access lists to determine
how the security server provides AAA services, this method has the least precedence.
Note Prior to configuring AAA Server Group Selection Based on DNIS, you must configure the list of
RADIUS server hosts and configure the AAA server groups. See the sections “Configuring Router
to RADIUS Server Communication” and “Configuring AAA Server Groups” of this chapter.
To configure the router to select a particular AAA server group based on the DNIS of the server group,
configure DNIS mapping. To map a server group with a group name with DNIS number, use the
following commands in global configuration mode:
Command Purpose
Step 1 Router(config)# aaa dnis map enable Enables DNIS mapping.
Step 2 Router(config)# aaa dnis map dnis-number Maps a DNIS number to a defined AAA server group;
authentication ppp group server-group-name the servers in this server group are being used for
authentication.
Step 3 Router(config)# aaa dnis map dnis-number Maps a DNIS number to a defined AAA server group;
authorization network group server-group-name the servers in this server group are being used for
authorization.
Step 4 Router(config)# aaa dnis map dnis-number accounting Maps a DNIS number to a defined AAA server group;
network [none | start-stop | stop-only] group the servers in this server group are being used for
server-group-name
accounting.
Note Prior to configuring AAA preauthentication, you must enable the aaa new-model command and
make sure the supporting preauthentication application is running on a RADIUS server in your
network.
To configure AAA preauthentication, use the following commands beginning in global configuration
mode:
Command Purpose
Step 1 Router(config)# aaa preauth Enters AAA preauthentication configuration
mode.
Step 2 Router(config-preauth)# group server-group Specifies the AAA RADIUS server group to use
for preauthentication.
Command Purpose
Step 3 Router(config-preauth)# clid [if-avail | required] Preauthenticates calls on the basis of the CLID
[accept-stop] [password string] number.
Step 4 Router(config-preauth)# ctype [if-avail | required] Preauthenticates calls on the basis of the call type.
[accept-stop] [password string]
Step 5 Router(config-preauth)# dnis [if-avail | required] Preauthenticates calls on the basis of the DNIS
[accept-stop] [password string] number.
Step 6 Router(config-preauth)# dnis bypass {dnis-group-name} Specifies a group of DNIS numbers that will be
bypassed for preauthentication.
To configure DNIS preauthentication, use the following commands beginning in global configuration
mode:
Command Purpose
Step 1 Router(config)# aaa preauth Enters AAA preauthentication mode.
Step 2 Router(config-preauth)# group {radius | tacacs+ | (Optional) Selects the security server to use for
server-group} AAA preauthentication requests. The default is
RADIUS.
Step 3 Router(config-preauth)# dnis [password string] Enables preauthentication using DNIS and
optionally specifies a password to use in
Access-Request packets.
In addition to configuring preauthentication on your Cisco router, you must set up the preauthentication
profiles on the RADIUS server. For information on setting up the preauthentication profiles, see the
following sections:
• Setting Up the RADIUS Profile for DNIS or CLID Preauthentication
• Setting Up the RADIUS Profile for Call Type Preauthentication
• Setting Up the RADIUS Profile for Preauthentication Enhancements for Callback
• Setting Up the RADIUS Profile for a Remote Host Name Used for Large-Scale Dial-Out
• Setting Up the RADIUS Profile for Modem Management
• Setting Up the RADIUS Profile for Subsequent Authentication
• Setting Up the RADIUS Profile for Subsequent Authentication Type
• Setting Up the RADIUS Profile to Include the Username
• Setting Up the RADIUS Profile for Two-Way Authentication
• Setting Up the RADIUS Profile to Support Authorization
Note The preauthentication profile must have “outbound” as the service type because the password is
predefined on the NAS. Setting up the preauthentication profile in this manner prevents users from
trying to log in to the NAS with the username of the DNIS number, CLID number, or call type and
an obvious password. The “outbound” service type is also included in the access-request packet sent
to the RADIUS server.
Note The preauthentication profile must have “outbound” as the service type because the password is
predefined on the NAS. Setting up the preauthentication profile in this manner prevents users from
trying to log in to the NAS with the username of the DNIS number, CLID number, or call type and
an obvious password. The “outbound” service type is also included in the access-request packet sent
to the RADIUS server and should be a check-in item if the RADIUS server supports check-in items.
Note The destination IP address is not required to be returned from the RADIUS server.
The following example shows a RADIUS profile configuration with a callback number of 555-1111 and
the service type set to outbound. The cisco-avpair = “preauth:send-name=<string>” uses the string
“andy” and the cisco-avpair = “preauth:send-secret=<string>” uses the password “cisco.”
5551111 password = “cisco”, Service-Type = Outbound
Service-Type = Callback-Framed
Framed-Protocol = PPP,
Dialback-No = “5551212”
Class = “ISP12”
cisco-avpair = “preauth:send-name=andy”
cisco-avpair = “preauth:send-secret=cisco”
Setting Up the RADIUS Profile for a Remote Host Name Used for Large-Scale Dial-Out
The following example adds to the previous example by protecting against accidentally calling a valid
telephone number but accessing the wrong router by providing the name of the remote, for use in
large-scale dial-out:
5551111 password = "cisco", Service-Type = Outbound
Service-Type = Callback-Framed
Framed-Protocol = PPP,
Dialback-No = "5551212"
Class = "ISP12"
cisco-avpair = "preauth:send-name=andy"
cisco-avpair = "preauth:send-secret=cisco"
cisco-avpair = "preauth:remote-name=Router2"
The modem management string within the VSA may contain the following:
Command Argument
min-speed <300 to 56000>, any
max-speed <300 to 56000>, any
modulation K56Flex, v22bis, v32bis, v34, v90, any
error-correction lapm, mnp4
compression mnp5, v42bis
When the modem management string is received from the RADIUS server in the form of a VSA, the
information is passed to the Cisco IOS software and applied on a per-call basis. Modem ISDN channel
aggregation (MICA) modems provide a control channel through which messages can be sent during the
call setup time. Hence, this modem management feature is supported only with MICA modems and
newer technologies. This feature is not supported with Microcom modems.
For more information on modem management, refer to the “Modem Configuration and Management”
chapter of the Cisco IOS Dial Technologies Configuration Guide, Release 12.2.
where <n> has the same value range as attribute 201 (that is, 0 or 1).
If attribute 201 is missing in the preauthentication profile, then a value of 1 is assumed, and subsequent
authentication is performed.
Note To perform subsequent authentication, you must set up a regular user profile in addition to a
preauthentication profile.
String Description
chap Requires username and password of CHAP for PPP authentication.
ms-chap Requires username and password of MS-CHAP for PPP authentication.
pap Requires username and password of PAP for PPP authentication.
To specify that multiple authentication types are allowed, you can configure more than one instance of
this VSA in the preauthentication profile. The sequence of the authentication type VSAs in the
preauthentication profile is significant because it specifies the order of authentication types to be used
in the PPP negotiation.
This VSA is a per-user attribute and replaces the authentication type list in the ppp authentication
interface command.
Note You should use this VSA only if subsequent authentication is required because it specifies the
authentication type for subsequent authentication.
If no username is specified, the DNIS number, CLID number, or call type is used, depending on the last
preauthentication command that has been configured (for example, if clid was the last preauthentication
command configured, the CLID number will be used as the username).
If subsequent authentication is used to authenticate a call, there might be two usernames: one provided
by RADIUS and one provided by the user. In this case, the username provided by the user overrides the
one contained in the RADIUS preauthentication profile; the username provided by the user is used for
both authentication and accounting.
Note The ppp authentication command must be configured with the radius method.
To apply for PAP, do not configure the ppp pap sent-name password command on the interface. The
vendor-specific attributes (VSAs) “preauth:send-name” and “preauth:send-secret” will be used as the
PAP username and PAP password for outbound authentication.
For CHAP, “preauth:send-name” will be used not only for outbound authentication, but also for inbound
authentication. For a CHAP inbound case, the NAS will use the name defined in “preauth:send-name”
in the challenge packet to the caller networking device. For a CHAP outbound case, both
“preauth:send-name” and “preauth:send-secret” will be used in the response packet.
The following example shows a configuration that specifies two-way authentication:
5551111 password = "cisco", Service-Type = Outbound
Service-Type = Framed-User
cisco-avpair = "preauth:auth-required=1"
cisco-avpair = "preauth:auth-type=pap"
cisco-avpair = "preauth:send-name=andy"
cisco-avpair = "preauth:send-secret=cisco"
class = "<some class>"
Note Two-way authentication does not work when resource pooling is enabled.
where <n> is one of the standard RFC 2138 values for attribute 6. For a list of possible Service-Type
values, refer to the appendix RADIUS Attributes.
Note If subsequent authentication is required, the authorization attributes in the preauthentication profile
will not be applied.
Command Purpose
Router(config-if)# isdn guard-timer milliseconds Sets an ISDN guard timer to accept or reject a call in the
[on-expiry {accept | reject}] event that the RADIUS server fails to respond to a
preauthentication request.
Router(control-config)# call guard-timer milliseconds Sets a CAS guard timer to accept or reject a call in the event
[on-expiry {accept | reject}] that the RADIUS server fails to respond to a
preauthentication request.
The order in which the hosts are entered is the order in which they are attempted. Use the
ip tcp synwait-time command to set the number of seconds that the network access server waits before
trying to connect to the next host on the list; the default is 30 seconds.
Your RADIUS server might permit more than three Login-IP-Host entries; however, the network access
server supports only three hosts in access-accept packets.
To allow user responses to echo, set the attribute to Echo. If the Prompt attribute is not included in the
user profile, responses are echoed by default.
This attribute overrides the behavior of the radius-server challenge-noecho command configured on
the access server. For example, if the access server is configured to suppress echoing, but the individual
user profile allows echoing, then the user responses are echoed.
Note To use the Prompt attribute, your RADIUS server must be configured to support access-challenge
packets.
Command Purpose
Step 1 Router(config)# aaa new-model Enables the AAA access control model.
Step 2 Router(config)# aaa route download min Enables the download static route feature and sets the
amount of time between downloads.
Step 3 Router(config)# aaa authorization configuration Downloads static route configuration information
default from the AAA server using TACACS+ or RADIUS.
Step 4 Router(config)# interface dialer 1 Defines a dialer rotary group.
Step 5 Router(config-if)# dialer aaa Allows a dialer to access the AAA server for dialing
information.
Step 6 Router(config-if)# dialer aaa suffix suffix password Allows a dialer to access the AAA server for dialing
password information and specifies a suffix and nondefault
password for authentication.
Command Purpose
Router# debug radius Displays information associated with RADIUS.
Router# show radius statistics Displays the RADIUS statistics for accounting and
authentication packets.
RADIUS Attributes
The network access server monitors the RADIUS authorization and accounting functions defined by
RADIUS attributes in each user-profile. For a list of supported RADIUS attributes, refer to the appendix
“RADIUS Attributes.”
This section includes the following sections:
• Vendor-Proprietary RADIUS Attributes
• RADIUS Tunnel Attributes
The lines in this sample RADIUS authentication and authorization configuration are defined as follows:
• The aaa authentication login use-radius group radius local command configures the router to use
RADIUS for authentication at the login prompt. If RADIUS returns an error, the user is
authenticated using the local database. In this example, use-radius is the name of the method list,
which specifies RADIUS and then local authentication.
• The aaa authentication ppp user-radius if-needed group radius command configures the
Cisco IOS software to use RADIUS authentication for lines using PPP with CHAP or PAP if the user
has not already been authorized. If the EXEC facility has authenticated the user, RADIUS
authentication is not performed. In this example, user-radius is the name of the method list defining
RADIUS as the if-needed authentication method.
• The aaa authorization exec default group radius command sets the RADIUS information that is
used for EXEC authorization, autocommands, and access lists.
• The aaa authorization network default group radius command sets RADIUS for network
authorization, address assignment, and access lists.
The lines in this example RADIUS authentication, authorization, and accounting configuration are
defined as follows:
• The radius-server host command defines the IP address of the RADIUS server host.
• The radius-server key command defines the shared secret text string between the network access
server and the RADIUS server host.
• The aaa authentication ppp dialins group radius local command defines the authentication
method list “dialins,” which specifies that RADIUS authentication and then (if the RADIUS server
does not respond) local authentication will be used on serial lines using PPP.
• The ppp authentication pap dialins command applies the “dialins” method list to the lines
specified.
• The aaa authorization network default group radius local command is used to assign an address
and other network parameters to the RADIUS user.
• The aaa accounting network default start-stop group radius command tracks PPP usage.
• The aaa authentication login admins local command defines another method list, “admins,” for
login authentication.
• The login authentication admins command applies the “admins” method list for login
authentication.
The lines in this example RADIUS authentication, authorization, and accounting configuration are
defined as follows:
• The radius-server host non-standard command defines the name of the RADIUS server host and
identifies that this RADIUS host uses a vendor-proprietary version of RADIUS.
• The radius-server key command defines the shared secret text string between the network access
server and the RADIUS server host.
• The radius-server configure-nas command defines that the Cisco router or access server will query
the RADIUS server for static routes and IP pool definitions when the device first starts up.
• The aaa authentication ppp dialins group radius local command defines the authentication
method list “dialins,” which specifies that RADIUS authentication, and then (if the RADIUS server
does not respond) local authentication will be used on serial lines using PPP.
• The ppp authentication pap dialins command applies the “dialins” method list to the lines
specified.
• The aaa authorization network default group radius local command is used to assign an address
and other network parameters to the RADIUS user.
• The aaa accounting network default start-stop group radius command tracks PPP usage.
• The aaa authentication login admins local command defines another method list, “admins,” for
login authentication.
• The login authentication admins command applies the “admins” method list for login
authentication.
Multiple RADIUS Server Entries for the Same Server IP Address Example
The following example shows how to configure the network access server to recognize several RADIUS
host entries with the same IP address. Two different host entries on the same RADIUS server are
configured for the same services—authentication and accounting. The second host entry configured acts
as fail-over backup to the first one. (The RADIUS host entries will be tried in the order they are
configured.)
! This command enables AAA.
aaa new-model
! The next command configures default RADIUS parameters.
aaa authentication ppp default group radius
! The next set of commands configures multiple host entries for the same IP address.
radius-server host 172.20.0.1 auth-port 1000 acct-port 1001
radius-server host 172.20.0.1 auth-port 2000 acct-port 2001
The following example shows how to create server group radgroup2 with three RADIUS server
members, each with the same IP address but with unique authentication and accounting ports:
aaa group server radius radgroup2
server 172.16.1.1 auth-port 1000 acct-port 1001
server 172.16.1.1 auth-port 2000 acct-port 2001
server 172.16.1.1 auth-port 3000 acct-port 3001
Note In cases where both global commands and server commands are used, the server command will take
precedence over the global command.
! The following commands define the group2 RADIUS server group and associate servers
! with it and configures a deadtime of two minutes.
aaa group server radius group2
server 2.2.2.2 auth-port 2000 acct-port 2001
server 3.3.3.3 auth-port 1645 acct-port 1646
deadtime 2
! The following set of commands configures the RADIUS attributes for each host entry
! associated with one of the defined server groups.
radius-server host 1.1.1.1 auth-port 1645 acct-port 1646
radius-server host 2.2.2.2 auth-port 2000 acct-port 2001
radius-server host 3.3.3.3 auth-port 1645 acct-port 1646
! The following commands define the sg1 RADIUS server group and associate servers
! with it.
aaa group server radius sg1
server 172.16.0.1
server 172.17.0.1
! The following commands define the sg2 RADIUS server group and associate a server
! with it.
aaa group server radius sg2
server 172.18.0.1
! The following commands define the sg3 RADIUS server group and associate a server
! with it.
aaa group server radius sg3
server 172.19.0.1
! The following commands define the default-group RADIUS server group and associate
! a server with it.
aaa group server radius default-group
server 172.20.0.1
!
! The next set of commands configures default-group RADIUS server group parameters.
aaa authentication ppp default group default-group
aaa accounting network default start-stop group default-group
!
! The next set of commands enables DNIS mapping and maps DNIS numbers to the defined
! RADIUS server groups. In this configuration, all PPP connection requests using
! DNIS 7777 are sent to the sg1 server group. The accounting records for these
! connections (specifically, start-stop records) are handled by the sg2 server group.
! Calls with a DNIS of 8888 use server group sg3 for authentication and server group
! default-group for accounting. Calls with a DNIS of 9999 use server group
! default-group for authentication and server group sg3 for accounting records
! (stop records only). All other calls with DNIS other than the ones defined use the
! server group default-group for both authentication and stop-start accounting records.
aaa dnis map enable
aaa dnis map 7777 authentication ppp group sg1
aaa dnis map 7777 accounting network start-stop group sg2
aaa dnis map 8888 authentication ppp group sg3
aaa dnis map 9999 accounting network stop-only group sg3
The following example shows a configuration that specifies that both the DNIS number and the CLID
number be used for preauthentication. DNIS preauthentication will be performed first, followed by
CLID preauthentication.
aaa preauth
group radius
dnis required
clid required
The following example specifies that preauthentication be performed on all DNIS numbers except the
two DNIS numbers specified in the DNIS group called “hawaii”:
aaa preauth
group radius
dnis required
dnis bypass hawaii
The following example shows a sample AAA configuration with DNIS preauthentication:
aaa new-model
aaa authentication login CONSOLE none
aaa authentication login RADIUS_LIST group radius
aaa authentication login TAC_PLUS group tacacs+ enable
aaa authentication login V.120 none
aaa authentication enable default enable group tacacs+
aaa authentication ppp RADIUS_LIST if-needed group radius
aaa authorization exec RADIUS_LIST group radius if-authenticated
aaa authorization exec V.120 none
aaa authorization network default group radius if-authenticated
aaa authorization network RADIUS_LIST if-authenticated group radius
aaa authorization network V.120 group radius if-authenticated
aaa accounting suppress null-username
aaa accounting exec default start-stop group radius
aaa accounting commands 0 default start-stop group radius
Note To configure preauthentication, you must also set up preauthentication profiles on the RADIUS
server.
aaa preauth
group radius
dnis required
The following example shows a CAS guard timer that is set at 20,000 milliseconds. A call will be
accepted if the RADIUS server has not responded to a preauthentication request when the timer expires.
controller T1 0
framing esf
clock source line primary
linecode b8zs
ds0-group 0 timeslots 1-24 type e&m-fgb dtmf dnis
cas-custom 0
call guard-timer 20000 on-expiry accept
aaa preauth
group radius
dnis required
LNS = partner
! Allow the LAC to respond to dialin requests using L2TP from IP address 172.21.9.13
! domain “cisco.com.”
request dialin
protocol l2tp
domain cisco.com
initiate-ip to 172.21.9.13
local name nas-1
The following example shows how to configure the LAC if RADIUS tunnel attributes are supported. In
this example, there is no local VPDN configuration on the LAC; the LAC, instead, is configured to query
the remote RADIUS security server.
! Enable global AAA securities services.
aaa new-model
! Enable AAA authentication for PPP and list RADIUS as the default method to use
! for PPP authentication.
aaa authentication ppp default group radius local
! Enable AAA (network) authorization and list RADIUS as the default method to use for
! authorization.
aaa authorization network default group radius
! Define the username as “DJ.”
username DJ password 7 030C5E070A00781B
! Enable VPDN.
vpdn enable
! Configure the LAC to interface with the remote RADIUS security server.
radius host 171.69.1.1 auth-port 1645 acct-port 1646
radius-server key cisco
The following example shows how to configure the LNS with a basic L2F and L2TP configuration using
RADIUS tunneling attributes:
aaa new-model
aaa authentication login default none
aaa authentication login console none
aaa authentication ppp default local group radius
aaa authorization network default group radius if-authenticated
!
username l2f-cli-auth-id password 0 l2f-cli-pass
username l2f-svr-auth-id password 0 l2f-svr-pass
username l2tp-svr-auth-id password 0 l2tp-tnl-pass
!
vpdn enable
vpdn search-order domain
!
vpdn-group 1
accept-dialin
protocol l2f
virtual-template 1
terminate-from hostname l2f-cli-auth-id
local name l2f-svr-auth-id
!
vpdn-group 2
accept-dialin
protocol l2tp
virtual-template 2
terminate-from hostname l2tp-cli-auth-id
local name l2tp-svr-auth-id
!
interface Ethernet1/0
ip address 10.0.0.3 255.255.255.0
no ip route-cache
no ip mroute-cache
!
interface Virtual-Template1
ip unnumbered Ethernet1/0
ppp authentication pap
!
interface Virtual-Template2
ip unnumbered Ethernet1/0
ppp authentication pap
!
radius-server host 1.1.1.1 auth-port 1645 acct-port 1646
radius-server key <deleted>
!