System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

RADIUS server groups

Updated: September 18, 2026

Want to summarize with AI?

Log in

Explains how Cisco IOS XR groups external RADIUS server hosts so AAA method lists can use named server groups for AAA service selection.

A RADIUS server group is a network authentication mechanism that

  • consists of a named list of external RADIUS server hosts

  • allows AAA method lists to reference the group for authentication, authorization, or accounting, and

  • supports up to 30 servers and 30 private servers per group in Cisco IOS XR.

Additional reference information

When configuring RADIUS server groups, you can enter one or more server commands. Each server command specifies the hostname or IP address of an external RADIUS server, and can include optional port numbers. Once configured, a RADIUS server group can be referenced in AAA method lists to select the appropriate group for authentication, authorization, or accounting tasks.

You can configure a maximum of:

  • 30 servers per RADIUS server group

  • 30 private servers per RADIUS server group

Configure RADIUS server groups

Create a named RADIUS server group that can be referenced in AAA method lists.

This task configures RADIUS server groups by grouping external RADIUS servers under a named group. The group can be used within AAA method lists for authentication, authorization, or accounting. You can configure up to 30 servers and 30 private servers per RADIUS server group.

Before you begin

Ensure the external RADIUS servers are accessible at the time of configuration.

Procedure

  1. Enter global configuration mode.

    Example:

    Router# configure

    Enters global configuration mode.

  2. Create the RADIUS server group.

    Example:

    Router(config)# aaa group server radius radgroup1

    Groups different server hosts into distinct lists and enters the server group configuration mode.

  3. Add the RADIUS server to the server group.

    Example:

    Router(config-sg-radius)# server 192.168.20.0

    Specifies the hostname or IP address of an external RADIUS server.

    • After the server group is configured, it can be referenced from the AAA method lists (used while configuring authentication, authorization, or accounting).

  4. Repeat step 4 for every external server to be added to the server group named in step 3.

  5. Configure the RADIUS server-group deadtime.

    Example:

    Router(config-sg-radius)# deadtime 1

    Configures the deadtime value at the RADIUS server group level.

    • The minutes argument specifies the length of time, in minutes, for which a RADIUS server is skipped over by transaction requests, up to a maximum of 1440 (24 hours). The range is from 1 to 1440.

    The example specifies a one-minute deadtime for RADIUS server group radgroup1 when it has failed to respond to authentication requests for the deadtime command

    Note

    You can configure the group-level deadtime after the group is created.

  6. Commit or discard the configuration changes.

    Example:

    commit
end

    Use one of these options:

    • commit: Saves the configuration changes and remains within the configuration session.

    • end: Prompts you to save, discard, or cancel the configuration changes before leaving the configuration session.

    • Yes: Saves configuration changes and exits the configuration session.

    • No: Exits the configuration session without committing the configuration changes.

    • Cancel: Remains in the configuration session without committing the configuration changes.

  7. Display RADIUS server group information.

    Example:

    Router# show radius server-groups

    (Optional) Displays information about each RADIUS server group that is configured in the system.

The RADIUS server group is configured and available for use in AAA method lists.