System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Router-to-RADIUS server communications

Updated: September 18, 2026

Want to summarize with AI?

Log in

Explains the RADIUS server host communication parameters that Cisco IOS XR uses to reach external RADIUS servers for authentication and accounting services.

A router-to-RADIUS server communication configuration is a RADIUS client configuration that

  • identifies external RADIUS server hosts by hostname, IP address, and authentication or accounting UDP port numbers

  • allows per-server timeout, retransmission, and key values to override global RADIUS values when both are configured, and

  • enables the source-interface setting to force outgoing RADIUS packets to use a specific interface or VRF-specific interface.

Additional reference information

Router-to-RADIUS server communications are configured to define how the router interacts with external RADIUS server hosts. The RADIUS host is typically a multiuser system running RADIUS server software from providers such as Cisco (CiscoSecure ACS), Livingston, Merit, or Microsoft. Key configurable components include:

  • Hostname or IP address

  • Authentication destination port

  • Accounting destination port

  • Retransmission value

  • Timeout period

  • Key string

RADIUS security servers are uniquely identified using either hostname or IP address, TCP/UDP port numbers, or combinations thereof. This enables RADIUS requests to be directed to multiple ports on the same server. If multiple host entries exist for the same service (such as accounting), backup switching is automatic—the second entry is used if the first fails. Host entries are tried in configuration order.

A router and RADIUS server use a shared secret (key string) to encrypt passwords and exchange responses. Global parameters can be set for timeout, retransmission, and encryption key values; these can also be specified per server and per global/per-server combinations. To set parameters globally, use the commands: radius-server timeout , radius-server retransmit , and radius-server key . For per-server settings, use the radius-server host command.

You can configure a maximum of 30 global RADIUS servers.

Note

You can configure both global and per-server timeout, retransmission, and key value commands at the same time. If both are configured, the per-server settings override the global settings.

RADIUS summary example

radius source-interface Mgm0/rp0/cpu0/0 vrf default
radius-server timeout 10
radius-server retransmit 2
!
! OOB RADIUS
radius-server host 192.0.2.10 auth-port 1812 acct-port 1813
key cisco123
timeout 10
retransmit 2
!
radius-server host 192.0.2.11 auth-port 1812 acct-port 1813
key cisco123
timeout 10
retransmit 2
!
aaa group server radius radgrp
server 192.0.2.10 auth-port 1812 acct-port 1813
server 192.0.2.11 auth-port 1812 acct-port 1813
!
aaa authorization exec radauthen group radgrp local
aaa authentication login radlogin group radgrp local
!
line template vty
authorization exec radauthen
login authentication radlogin
timestamp disable
exec-timeout 0 0
!
vty-pool default 0 99 line-template vty

Configure router to communicate with a RADIUS server

Set up router communication with one or more external RADIUS servers by specifying global and server-specific values for authentication, accounting, timing, security, and interface sources.

Use this task to establish proper communication between the router and external RADIUS servers. You'll define global defaults, configure specific server hosts, and verify operation as needed.

Before you begin

  • Ensure the external RADIUS server is reachable from the router.

  • Gather required information such as server IP addresses or hostnames, authentication and accounting port numbers, retransmission attempts, timeout intervals, and shared secrets.

Procedure

  1. Enter global configuration mode.

    Example:

    Router# configure

    Enters global configuration mode.

  2. Configure the RADIUS server host.

    Example:

    Router(config)# radius-server host host1

    Specifies the hostname or IP address of the remote RADIUS server host.

    • Use the auth-port port-number option to configure a specific UDP port on this RADIUS server to be used solely for authentication.

    • Use the acct-port port-number option to configure a specific UDP port on this RADIUS server to be used solely for accounting.

    • To configure the network access server to recognize more than one host entry associated with a single IP address, simply repeat this command as many times as necessary, making sure that each UDP port number is different. Set the timeout, retransmit, and encryption key values to use with the specific RADIUS host.

    • If no timeout is set, the global value is used; otherwise, enter a value in the range 1 to 1000. If no retransmit value is set, the global value is used; otherwise enter a value in the range 1 to 100. If no key string is specified, the global value is used.

    Note

    The key is a text string that must match the encryption key used on the RADIUS server. Always configure the key as the last item in the radius-server hostcommand syntax because the leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key.

  3. Set the global RADIUS retransmission count.

    Example:

    Router(config)# radius-server retransmit 5

    Specifies the number of times the software searches the list of RADIUS server hosts before giving up.

    • In the example, the number of retransmission attempts is set to 5.

  4. Set the global RADIUS timeout interval.

    Example:

    Router(config)# radius-server timeout 10

    Sets the number of seconds a router waits for a server host to reply before timing out.

    • In the example, the interval timer is set to 10 seconds.

  5. Set the RADIUS shared secret key.

    Example:

    Router(config)# radius-server key 0 samplekey

    Sets the authentication and encryption key for all RADIUS communications between the router and the RADIUS daemon.

  6. Configure the RADIUS source interface.

    Example:

    Router(config)# radius source-interface 0/3/0/1

    (Optional) Forces RADIUS to use the IP address of a specified interface or subinterface for all outgoing RADIUS packets.

    • The specified interface or subinterface must have an IP address associated with it. If the specified interface or subinterface does not have an IP address or is in the down state, then RADIUS reverts to the default. To avoid this, add an IP address to the interface or subinterface or bring the interface to the up state.

    The vrf keyword enables the specification on a per-VRF basis.

  7. Repeat step 2 through step 6 for each external server to be configured.

  8. Commit or discard the configuration changes.

    Example:

    commit
end

    Use one of these options:

    • commit: Saves the configuration changes and remains within the configuration session.

    • end: Prompts you to save, discard, or cancel the configuration changes before leaving the configuration session.

    • Yes: Saves configuration changes and exits the configuration session.

    • No: Exits the configuration session without committing the configuration changes.

    • Cancel: Remains in the configuration session without committing the configuration changes.

  9. Display RADIUS server information.

    Example:

    Router# show radius

    (Optional) Displays information about the RADIUS servers that are configured in the system.

The router can now communicate with the configured RADIUS server hosts, and you can view the active RADIUS server configuration.