System Setup and Software Installation Guide for Cisco NCS 1004

PDF

System Setup and Software Installation Guide for Cisco NCS 1004

RADIUS security protocol

Updated: July 17, 2026

Want to summarize with AI?

Log in

This topic explains how RADIUS security protocol supports centralized authentication, authorization, and accounting management in distributed networks.

RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service. The protocol operates on a client-server model.

  • RADIUS clients operate on network devices such as NCS 1004.

  • RADIUS clients send authentication and accounting requests to the central RADIUS server.

  • RADIUS servers contain all the user authentication and network service access information.

The AAA security paradigm supports RADIUS, which can be used with other security protocols such as TACACS+, Kerberos, and local username lookup.

Configure RADIUS server groups

Before you begin

Ensure that the external server is accessible at the time of configuration.

RADIUS server groups allow you to organize external RADIUS servers into logical groups that can be referenced from AAA method lists for authentication, authorization, or accounting services.

You can enter one or more server commands. The server command specifies the hostname or IP address of an external RADIUS server and its port numbers. After configuration, the server group is referenced from the AAA method lists for authentication, authorization, or accounting.

You can configure up to 30 servers and private servers for each RADIUS server group.

Procedure

1.

Configure RADIUS server parameters. For details, see Configure RADIUS server parameters.
2.

Enable AAA authentication for the RADIUS server group. For details, see Enable RADIUS authentication.

Configure RADIUS server parameters

This task configures the basic RADIUS server group and adds external RADIUS servers with their IP addresses, authentication ports, accounting ports, and encryption keys.

Procedure

1.

Enter global configuration mode.

Example:

RP/0/RP0/CPU0:ios# configure
2.

Enter the aaa group server radius command to create a RADIUS server group and enter server group configuration mode.

Example:

RP/0/RP0/CPU0:ios(config)# aaa group server radius radgroup1

This command groups different server hosts into distinct lists.
3.

Enter the radius-server host command to specify the hostname or IP address of the RADIUS server host.

Example:

RP/0/RP0/CPU0:ios(config)# radius-server host 192.168.20.0
4.

Enter the auth-port command to specify the User Datagram Protocol (UDP) destination port for authentication requests.

Example:

RP/0/RP0/CPU0:ios(config)# auth-port 1812

If you set the value to 0, the host is not used for authentication. If you do not specify a value, the port number is 1645 by default.
5.

Enter the acct-port command to specify the UDP destination port for accounting requests.

Example:

RP/0/RP0/CPU0:ios(config)# acct-port 1813

If you set the value to 0, the host is not used for accounting. If you do not specify a value, the port number is 1646 by default.
6.

Enter the key command to specify the authentication and encryption key used between NCS 1004 and the RADIUS server.

Example:

RP/0/RP0/CPU0:ios(config-radius-host)# key 7 08984B1A4D0C19157A5F57

This key overrides the global setting of the radius-server key command. If you do not specify a key string, the global value is used.

The key is a text string that must match the encryption key used on the RADIUS server. Always configure the key as the last item in the radius-server host command syntax. This is because the leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in the key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key.
7.

Repeat steps 3 through 6 for each external RADIUS server that you want to add to the server group.

What to do next

After configuring the RADIUS server parameters, enable AAA authentication for the RADIUS server group. For details, see Enable RADIUS authentication.

Enable RADIUS authentication

Enable AAA for the RADIUS server group and verify the configuration.

Before you begin

Before you begin, ensure that you have configured RADIUS server parameters. For details, see Configure RADIUS server parameters.

Follow these steps to enable RADIUS authentication:

Procedure

1.

Enter the aaa authentication login command to specify the default method list for authentication and enable authentication for console in global configuration mode.

Example:

RP/0/RP0/CPU0:ios(config-radius-host)# aaa authentication login default group radius local
2.

Commit the configuration changes.

Example:

RP/0/RP0/CPU0:ios(config-radius-host)# commit

Alternatively, you can use the end command to commit and exit configuration mode.
3.

(Optional) Enter the show radius server-groups command to display information about each configured RADIUS server group in the system.

Example:

RP/0/RP0/CPU0:ios# show radius server-groups