System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Per-VRF AAA for RADIUS

Updated: September 18, 2026

Want to summarize with AI?

Log in

Explains how Cisco IOS XR utilizes VPN routing and forwarding instances to provide AAA services, enabling RADIUS communications to leverage VRF-specific server reachability.

A Per-VRF AAA service is a service model that

  • enables provider edge or virtual home gateways to communicate directly with a RADIUS server associated with a VPN

  • removes the need to route RADIUS communication through a RADIUS proxy, and

  • gives VPN owners more flexibility in how their RADIUS servers are reached.

Additional reference information

The Per-VRF AAA functionality enables AAA services to be based on VPN routing and forwarding (VRF) instances. The Provider Edge (PE) or Virtual Home Gateway (VHG) communicates directly with the customer's RADIUS server, which is associated with the customer's VPN, without the need for a RADIUS proxy. Internet service providers (ISPs) can scale their VPN offerings more efficiently and provide customers with greater flexibility by eliminating reliance on RADIUS proxies.

Cisco RADIUS vendor-specific attributes for per-VRF AAA

The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific information between the network access server and the RADIUS server by using the vendor-specific attribute (attribute 26). Attribute 26 encapsulates vendor-specific attributes, allowing vendors to support their own extended attributes not suitable for general use.

Cisco IOS XR RADIUS implementation supports the vendor-specific option using the format recommended in the specification. Cisco's vendor-ID is 9, and the supported option has vendor-type 1, named cisco-avpair. The value follows this format:

protocol: attribute sep value

  • Protocol: Cisco protocol value for a particular type of authorization.

  • Attribute and value: An attribute-value pair defined in the Cisco RADIUS specification.

  • Sep: Use "=" for mandatory attributes and "*" for optional attributes.

Supported Cisco VSAs for Per VRF AAA

All RADIUS VSAs listed below—rad-serv, rad-serv-source-if, and rad-serv-vrf—require the prefix aaa : before the VSA name.

Table 1. Supported VSAs for per VRF AAA

VSA Name

Value Type

Description
Note

The RADIUS VSAs - rad-serv, rad-serv-source-if, and rad-serv-vrf - must have the prefix "aaa:" before the VSA name.

Note

The RADIUS VSAs - rad-serv, rad-serv-source-if, and rad-serv-vrf - must have the prefix "aaa:" before the VSA name.

rad-serv

string

Indicates the IP address in IPv4 or IPv6 format, key, timeout, and retransmit number of a server and the group of the server.

The VSA syntax follows:

rad-serv=a.b.c.d [key SomeKey] [auth-port X] [acct-port Y]
                           [retransmit V] [timeout W].

Other than the IP address, all parameters are optional and are issued in any order. If the optional parameters are not specified, their default values are used.

The key cannot contain any spaces; for "retransmit V," "V" can range from 1 to 100; for "timeout W," the "W" can range from 1 to 1000.

rad-serv-vrf

string

Specifies the name of the VRF that is used to transmit RADIUS packets. The VRF name matches the name that was specified through the vrf command.

Additional Information

  • Use this reference to look up Cisco vendor-specific attribute 26, Cisco vendor ID 9, vendor type 1, cisco-avpair formatting, and the supported per-VRF AAA VSA names.

  • To configure the external RADIUS server correctly, ensure it returns the correct aaa:-prefixed VSA names and values for per-VRF AAA server, source-interface, and VRF information.

This task configures RADIUS server groups per VRF. For information about configuring TACACS+ server groups per VRF, refer Configure TACACS+ Server Groups section.

Configure per-VRF AAA server groups

Create a RADIUS server group that uses private server addresses and associates the group with a specific VRF.

Use per-VRF RADIUS server groups to direct AAA traffic over certain VRFs, allowing network segmentation and improved security by restricting authentication requests to servers reachable within the specified VRF.

Before you begin

Review the supported vendor-specific attributes for per-VRF AAA in your environment before configuring the server group.

Procedure

  1. Enter global configuration mode.

    Example:

    Router# configure

    Enters global configuration mode.

  2. Create the RADIUS server group.

    Example:

    Router(config)# aaa group server radius radgroup1

    Groups different server hosts into distinct lists and enters the server group configuration mode.

  3. Configure the private RADIUS server for the group.

    Example:

    Router(config-sg-radius)# server-private 10.1.1.1 timeout 5
Router(config-sg-radius)# server-private 10.2.2.2 retransmit 3

    Example:

    Router(config-sg-radius)# server-private 2001:db8:a0b:12f0::1/64 timeout 5
Router(config-sg-radius)# server-private 10.2.2.2 retransmit 3

    Configures the IP address of the private RADIUS server for the group.

    If private server parameters are not specified, global configurations are used. If global configurations are not specified, default values are used.

    Both auth-port and acct-port keywords enter RADIUS server-group private configuration mode.

    You can configure a maximum of 30 private servers per RADIUS server group.

  4. Configure the VRF reference for the RADIUS server group.

    Example:

    Router(config-sg-radius)# vrf v2.44.com

    Configures the VRF reference of an AAA RADIUS server group.

    Note

    Private server IP addresses can overlap with those configured globally and the VRF definitions can help to distinguish them.

  5. Commit or discard the configuration changes.

    Example:

    commit
end

    Use one of these options:

    • commit: Saves the configuration changes and remains within the configuration session.

    • end: Prompts you to save, discard, or cancel the configuration changes before leaving the configuration session.

    • Yes: Saves configuration changes and exits the configuration session.

    • No: Exits the configuration session without committing the configuration changes.

    • Cancel: Remains in the configuration session without committing the configuration changes.

The RADIUS server group is configured to use the specified private RADIUS servers and VRF reference for per-VRF AAA communication.