|
|
This chapter explains the function and syntax of the RADIUS commands. For more information about defaults and usage guidelines, see the corresponding chapter of the Cisco IOS Security Command Reference, Release 12.1.
To group different RADIUS server hosts into distinct lists and distinct methods, enter the aaa group server radius command in global configuration mode. To remove a group server from the configuration list, enter the no form of this command.
aaa group server radius group-name
Syntax Description
group-name Character string used to name the group of servers.
Syntax Description
This command has no arguments or keywords.
Syntax Description
subinterface-name Name of the interface that RADIUS uses for all of its outgoing packets.
Syntax Description
This command has no arguments or keywords.
Syntax Description
This command has no arguments or keywords.
Syntax Description
minutes Length of time a RADIUS server is skipped over by transaction requests, up to a maximum of 1440 minutes (24 hours).
The radius-server attribute nas-port extended command replaces this command. See the description of the radius-server attribute nas-port extended command in this chapter for more information.
Syntax Description
hostname DNS name of the RADIUS server host. ip-address IP address of the RADIUS server host. auth-port (Optional) Specifies the UDP destination port for authentication requests. port-number (Optional) Port number for authentication requests; the host is not used for authentication if set to 0. acct-port (Optional) Specifies the UDP destination port for accounting requests. port-number (Optional) Port number for accounting requests; the host is not used for accounting if set to 0. timeout (Optional) The time interval (in seconds) that the router waits for the RADIUS server to reply before retransmitting. This setting overrides the global value of the radius-server timeout command. If no timeout value is specified, the global value is used. Enter a value in the range 1 to 1000. seconds (Optional) Specifies the timeout value. Enter a value in the range 1 to 1000. If no timeout value is specified, the global value is used. retransmit (Optional) The number of times a RADIUS request is re-sent to a server, if that server is not responding or responding slowly. This setting overrides the global setting of the radius-server retransmit command. retries (Optional) Specifies the retransmit value. Enter a value in the range 1 to 100. If no retransmit value is specified, the global value is used. key (Optional) Specifies the authentication and encryption key used between the router and the RADIUS daemon running on this RADIUS server. This key overrides the global setting of the radius-server key command. If no key string is specified, the global value is used. The key is a text string that must match the encryption key used on the RADIUS server. Always configure the key as the last item in the radius-server host command syntax. This is because the leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in the key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key. string (Optional) Specifies the authentication and encryption key for all RADIUS communications between the router and the RADIUS server. This key must match the encryption used on the RADIUS daemon. All leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key.
Syntax Description
hostname DNS name of the RADIUS server host. ip-address IP address of the RADIUS server host.
Syntax Description
string The key used to set authentication and encryption. This key must match the encryption used on the RADIUS daemon.
Syntax Description
This command has no arguments or keywords.
Syntax Description
retries Maximum number of retransmission attempts. The default is 3 attempts.
Syntax Description
seconds Number that specifies the timeout interval in seconds. The default is 5 seconds.
Syntax Description
accounting (Optional) Limits the set of recognized vendor-specific attributes to only accounting attributes. authentication (Optional) Limits the set of recognized vendor-specific attributes to only authentication attributes.
To configure the IP address of the RADIUS server for the group server, use the server (RADIUS) command in group server configuration mode. To remove the associated server from the AAA group server, use the no form of this command.
server ip-address [auth-port port-number] [acct-port port-number]
Syntax Description
ip-address IP address of the RADIUS server host. auth-port port-number (Optional) Specifies the User Datagram Protocol (UDP) destination port for authentication requests. The port-number argument specifies the port number for authentication requests. The host is not used for authentication if this value is set to 0. acct-port port-number (Optional) Specifies the UDP destination port for accounting requests. The port number argument specifies the port number for accounting requests. The host is not used for accounting services if this value is set to 0.
Posted: Wed Jul 26 16:29:38 PDT 2000
Copyright 1989-2000©Cisco Systems Inc.