Table of Contents
Advertisement
Chapter 11
Configuring RADIUS and TACACS+ Servers
Configuring Settings for All RADIUS Servers
Beginning in privileged EXEC mode, follow these steps to configure global communication settings
between the bridge and all RADIUS servers:
Command
Step 1
configure terminal
Step 2
radius-server key string
Step 3
radius-server retransmit retries
Step 4
radius-server timeout seconds
Step 5
radius-server deadtime minutes
Step 6
radius-server attribute 32
include-in-access-req format %h
Step 7
end
Step 8
show running-config
Step 9
copy running-config startup-config
To return to the default setting for the retransmit, timeout, and deadtime, use the no forms of these
commands.
Configuring the Bridge to Use Vendor-Specific RADIUS Attributes
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating
vendor-specific information between the bridge and the RADIUS server by using the vendor-specific
attribute (attribute 26). Vendor-specific attributes (VSAs) allow vendors to support their own extended
attributes not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific
option by using the format recommended in the specification. Cisco's vendor ID is 9, and the supported
option has vendor type 1, which is named cisco-avpair. The value is a string with this format:
protocol : attribute sep value *
OL-4059-01
Purpose
Enter global configuration mode.
Specify the shared secret text string used between the bridge and all
RADIUS servers.
The key is a text string that must match the encryption key used on
Note
the RADIUS server. Leading spaces are ignored, but spaces within
and at the end of the key are used. If you use spaces in your key, do
not enclose the key in quotation marks unless the quotation marks
are part of the key.
Specify the number of times the bridge sends each RADIUS request to the
server before giving up. The default is 3; the range 1 to 1000.
Specify the number of seconds an bridge waits for a reply to a RADIUS
request before resending the request. The default is 5 seconds; the range is
1 to 1000.
Use this command to cause the Cisco IOS software to mark as "dead" any
RADIUS servers that fail to respond to authentication requests, thus
avoiding the wait for the request to time out before trying the next
configured server. A RADIUS server marked as dead is skipped by
additional requests for the duration of minutes that you specify, or unless
there are no servers not marked dead.
Note
If you set up more than one RADIUS server, you must configure the
RADIUS server deadtime for optimal performance.
Configure the bridge to send its system name in the NAS_ID attribute for
authentication.
Return to privileged EXEC mode.
Verify your settings.
(Optional) Save your entries in the configuration file.
Cisco Aironet 1400 Series Wireless Bridges Software Configuration Guide
Configuring and Enabling RADIUS
11-13
Advertisement
Table of Contents
