Authentication, Authorization, and Accounting Configuration Guide, Cisco IOS Release 15SY
AAA-Domain Stripping at Server Group Level
Download this chapter
AAA-Domain Stripping at Server Group LevelAAA-Domain Stripping at Server Group Level
Download the complete book
Authentication, Authorization, and Accounting Configuration Guide, Cisco IOS Release 15SYAuthentication, Authorization, and Accounting Configuration Guide, Cisco IOS Release 15SY (PDF - 1 MB)
 Feedback

Contents

AAA-Domain Stripping at Server Group Level

Last Updated: October 15, 2012

The AAA-Domain Stripping at Server Group Level feature allows domain stripping to be configured at the server group level.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Information About AAA-Domain Stripping at Server Group Level

You can remove the domain name from the username received at the global level by using the radius-server domain-stripping command. When the radius-server domain-stripping command is configured, all the AAA requests with "user@example.com" go to the remote RADIUS server with the reformatted username "user". The domain name is removed from the request.


Note
Domain stripping will not be done in a TACACS configuration.

The AAA Broadcast Accounting feature allows accounting information to be sent to multiple AAA servers at the same time, that is, accounting information can be broadcast to one or more AAA servers simultaneously. This functionality allows you to send accounting information to private and public AAA servers. It also provides redundant billing information for voice applications.

You can configure domain stripping at the server group level by using the domain-stripping command in server group RADIUS configuration mode. Per-server group configuration overrides the global configuration. If domain stripping is not enabled globally, but it is enabled in a server group, then it is enabled only for that server group. Also, if virtual routing and forwarding (VRF)-specific domain stripping is configured globally and in a server group for a different VRF, domain stripping is enabled in both the VRFs. VRF configurations are taken from server-group configuration mode. If server-group configurations are disabled in global configuration mode but are available in server-group configuration mode, all configurations in server-group configuration mode are applicable.

After the domain stripping and broadcast accounting are configured, you can create separate accounting records as per the configurations.

How to Configure AAA-Domain Stripping at Server Level Group

Configuring Domain Stripping at the Server Group Level

SUMMARY STEPS

1.    enable

2.   configure terminal

3.   aaa new-model

4.   aaa group server radius server-name

5.   domain-stripping [strip-suffix word] [right-to-left ] [prefix-delimiter word] [delimiter word]

6.   end


DETAILED STEPS
 Command or ActionPurpose
Step 1
enable


Example:

Device> enable

 
Enables privileged EXEC mode.
  • Enter your password if prompted.
 
Step 2
configure terminal


Example:

Device# configure terminal

 

Enters global configuration mode.

 
Step 3
aaa new-model


Example:

Device(config)# aaa new-model

 

Enables AAA.

 
Step 4
aaa group server radius server-name


Example:

Device(config)# aaa group server radius rad1

 
Adds the RADIUS server and enters server group RADIUS configuration mode.
  • The server-name argument specifies the RADIUS server group name.
 
Step 5
domain-stripping [strip-suffix word] [right-to-left ] [prefix-delimiter word] [delimiter word]


Example:

Device(config-sg-radius)# domain-stripping delimiter username@example.com

 

Configures domain stripping at the server group level.

 
Step 6
end


Example:

Device(config-sg-radius)# end

 

Exits server group RADIUS configuration mode and returns to the privileged EXEC mode.

 

Configuration Example for AAA-Domain Stripping at Server Group Level

Example: AAA-Domain Stripping at Server Group Level

The following example shows the domain stripping configuration at the server group level: 

Device> enable
Device# configure terminal
Device(config)# aaa new-model
Device(config)# aaa group server radius rad1
Device(config-sg-radius)# domain-stripping right-to-left delimiter @$/
Device(config-sg-radius)# end

Additional References

Related Documents

Related Topic Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

Security commands

Configuring Authentication

Authentication, Authorization, and Accounting Configuration Guide

Technical Assistance

Description Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for AAA-Domain Stripping at Server Group Level

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Table 1Feature Information for AAA-Domain Stripping at Server Group Level
Feature Name Releases Feature Information

AAA-Domain Stripping at Server Group Level

15.1(1)SY

The AAA-Domain Stripping at Server Group Level feature allows domain stripping to be configured at the server group level.

This feature was introduced in Cisco IOS Release 15.1(1)SY.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2012 Cisco Systems, Inc. All rights reserved.