Table Of Contents
Configuring the CSS as a Client of a RADIUS Server
RADIUS Configuration Quick Start
Configuring a RADIUS Server for Use with the CSS
Configuring Authentication Settings
Configuring Authorization Settings
Specifying a Primary RADIUS Server
Specifying a Secondary RADIUS Server
Configuring the RADIUS Server Timeouts
Configuring the RADIUS Server Retransmits
Configuring the RADIUS Server Dead-Time
Showing RADIUS Server Configuration Information
Configuring the CSS as a Client of a RADIUS Server
The Remote Authentication Dial-In User Service (RADIUS) protocol is a distributed client/server protocol that protects networks against unauthorized access. RADIUS uses the User Datagram Protocol (UDP) to exchange authentication and configuration information between the CSS authentication client and the active authentication server that contains all user authentication and network service access information. The RADIUS host is normally a multiuser system running RADIUS server software.
When a user remotely logs in to a CSS operating as a RADIUS client, the CSS sends an authentication request (including username, encrypted password, client IP address, and port ID) to the central RADIUS server. The RADIUS server is responsible for receiving user connection requests, authenticating users, and returning all configuration information necessary for the client to deliver services to the users. Transactions between the RADIUS client and the RADIUS server are authenticated through the use of a shared secret.
Once the RADIUS server receives the authentication request, it validates the sending client and consults a database of users to match the login request. If no response is returned by the RADIUS server within a period of time, the authentication request is retransmitted a predefined number of times. The RADIUS client can forward requests to an alternate secondary RADIUS server in the event that the primary server is down or is unreachable.
In a configuration where both a primary RADIUS server and a secondary RADIUS server are specified, and one or both of the RADIUS servers become unreachable, the CSS automatically transmits a keepalive authentication request to query the server(s). The CSS transmits the username "query" and the password "areyouup" to the RADIUS server (encrypted with the RADIUS server's key) to determine the server's state. The CSS continues to send this keepalive authentication request until the RADIUS server indicates it is available.
Use the radius-server command and its options to specify the RADIUS server host (primary RADIUS server, and, optionally, a secondary RADIUS server), communication time interval settings, and a shared secret text string. This command is available in global configuration mode.
This chapter contains the following major sections:
•
RADIUS Configuration Quick Start
•
•
•
•
•
•
•
After configuring the RADIUS server, enable RADIUS authentication for console and virtual logins (if the username and password pair is not in the local user database) through the virtual authentication and console authentication commands. Refer to Chapter 1, Controlling CSS Access for details on the two commands.
RADIUS Configuration Quick Start
Table 3-1 provides a quick overview of the steps required to configure the RADIUS feature on a CSS. Each step includes the CLI command required to complete the task. For a complete description of each feature and all the options associated with the CLI command, refer to the sections following the table.
Table 3-1 RADIUS Configuration Quick Start
1.
•
•
•
•
See the "Configuring Authentication Settings" section.
2.
3.
(config)# radius-server primary 172.27.56.76 secret Hello4.
(config)# radius-server secondary 172.27.56.79 secret Hello5.
#(config) virtual authentication primary radius6.
(config)# show radius config all(config)# show radius statistics all
The following running-configuration example shows the results of entering the commands in Table 3-1.
!*************************** GLOBAL ***************************radius-server primary 172.27.56.76 secret Hello auth-port 1645radius-server secondary 172.27.56.79 secret Hello auth-port 1645virtual authentication primary radiusConfiguring a RADIUS Server for Use with the CSS
This section provides background information on the setup of a RADIUS server. It is intended as a guide to help ensure proper communication with a RADIUS server and a CSS operating as a RADIUS client.
The following sections summarize the recommended settings for the Cisco Secure Access Control Server (ACS) when used as a centralized RADIUS server with the CSS.
Configuring Authentication Settings
To configure the authentication settings on Cisco Secure ACS, go to the Network Configuration section of the Cisco Secure ACS HTML interface, the Add AAA Client page, and complete the following fields:
•
•
•
•
Configuring Authorization Settings
To determine the privilege level of users accessing the CSS, you must configure the user accounts on the RADIUS server.
To configure the group authorization settings:
1.
2.
To add a user to a group, go to the User Setup section of the Cisco Secure ACS HTML interface:
•
•
–
–
–
Specifying a Primary RADIUS Server
To specify a primary RADIUS server used to authenticate user information from the CSS RADIUS client (console or virtual authentication), use the radius-server primary command . The syntax for this global configuration mode command is:
radius-server primary ip_address secret string {auth-port port_number}
Options and variables for this command are as follows:
•
•
•
To specify a primary RADIUS server, enter:
(config)# radius-server primary 172.27.56.76 secret Hello auth-port 30658To remove a primary RADIUS server, enter:
(config)# no radius-server primarySpecifying a Secondary RADIUS Server
The CSS directs authentication requests to the secondary RADIUS server when the specified RADIUS primary server is unavailable. To specify a secondary RADIUS server to authenticate user information from the CSS RADIUS client (console or virtual authentication), use the radius-server secondary command.
Note
The syntax for this global configuration mode command is:
radius-server secondary ip_address secret string {auth-port port_number}
Options and variables for this command are as follows:
•
•
•
To specify a secondary RADIUS server, enter:
(config) radius-server secondary 172.27.56.79 secret Hello auth-port 30658To remove a secondary RADIUS server, enter:
(config)# no radius-server secondaryConfiguring the RADIUS Server Timeouts
By default, the CSS waits 10 seconds for the RADIUS server (primary or secondary) to reply to an authentication request before retransmitting requests to the RADIUS server. Use the radius-server timeout command to specify the time interval that the CSS waits for the RADIUS server (primary or secondary) to reply to an authentication request before retransmitting requests to the RADIUS server. You configure the number of retransmitted requests to the server through the radius-server retransmit command (see the "Configuring the RADIUS Server Retransmits" section). Valid entries are 1 to 255 seconds.
For example, to configure the configure the RADIUS server timeout interval to 1 minute (60 seconds), enter:
(config)# radius-server timeout 60To reset the RADIUS server retransmit request to the default of 10 seconds, enter:
(config)# no radius-server timeoutConfiguring the RADIUS Server Retransmits
By default, the CSS retransmits three authentication requests to a timed-out RADIUS server before considering the server dead and stopping transmission. Use the radius-server retransmit command to specify the number of times the CSS retransmits an authentication request to a timed-out RADIUS server before considering the server dead and stopping transmission. If a secondary RADIUS server has been identified, the server is selected as the active server. Valid entries are 1 to 30 retries.
If the RADIUS server does not respond to the CSS retransmitted requests, the CSS considers the server as dead, stops transmitting to the server, and starts the dead timer as defined through the radius-server dead-time command (see the "Configuring the RADIUS Server Dead-Time" section). If a secondary server is configured, the CSS transmits the requests to the secondary server. If the secondary server does not respond to the request, the CSS considers the server dead and starts the dead timer. If there is no active server, the CSS stops transmitting requests until the primary RADIUS server becomes alive.
For example, to configure the number of RADIUS server retransmissions to 5, enter:
(config)# radius-server retransmit 5To reset the RADIUS server retransmit request to the default of 3 retransmissions, enter:
(config)# no radius-server retransmitConfiguring the RADIUS Server Dead-Time
During the dead-time interval, the CSS sends probe access-request packets to verify that the RADIUS server (primary or secondary) is available and can receive authentication requests. The dead-time interval starts when the server does not respond to the number of authentication request transmissions configured through the radius-server retransmit command. When the server responds to a probe access-request packet, the CSS transmits the authentication request to the server.
Use the radius-server dead-time command to set the time interval in which the CSS verifies whether a nonresponsive server is operational. Valid entries are 1 to 255 seconds. The default is 5 seconds.
To configure the RADIUS server dead-time to 15 seconds, with probe access-requests enabled, enter:
(config)# radius-server dead-time 15To reset the RADIUS server dead-time request to the default of 5 seconds, enter:
(config)# no radius-server dead-timeShowing RADIUS Server Configuration Information
Use the show radius command to display information and statistics about the RADIUS server configuration. The syntax and options for the command are as follows:
•
•
To view the configuration for a RADIUS primary server, enter:
(config)# show radius config primaryTo view the authentication statistics for a RADIUS secondary server, enter:
(config)# show radius statistics secondaryTable 3-2 describes the fields in the show radius config command output.
Table 3-3 describes the fields in the show radius statistics output.
