Configure the RADIUS server with user credentials and policy

Updated: March 10, 2026

Want to summarize with AI?

Provides parameters and configuration details for setting up a RADIUS server to support SD-WAN RA headend authentication and policy management.

The SD-WAN RA headend relies on the RADIUS server as the repository of remote access user authentication credentials, and of policy configuration details, such as VRF, security group tag (SGT), IP pool name, and server subnets. Using the RADIUS server for these functions is preferable to trying to manage credential and policy configuration on each remote access headend device, as the RADIUS server centralizes this configuration and provides scalability.

The RADIUS server also functions as an extensible authentication protocol (EAP) server when remote access clients use the EAP authentication method.

This task requires a working knowledge of RADIUS server configuration.

To support the SD-WAN RA headend, ensure that these parameters are configured on the RADIUS server. These parameters are required for enabling remote access connections:

User authentication credentials
- Username and password for AnyConnect-EAP connections
- Pre-shared keys for the pre-shared key authentication method
- EAP credentials for EAP authentication method
Policy parameters that apply to a user or to a user group
- VRF: Service VPN that the remote access user is assigned to
- IP pool name: Name of the IP pool defined on the remote access headend
- Server subnets: Subnet access to provide to the remote access user
- SGT: Trustsec SGT tag to assign to the user traffic

For full configuration information, see the RADIUS documentation. For a list of supported attributes, see FlexVPN RADIUS Attributes.

For reference, see this subset of RADIUS parameters. These parameters are required, to enable SD-WAN RA to establish remote access connections.

Table 1. Subset of the parameters in a user profile
Parameter	Description
Profile name	Remote access user identity. Example: user1@example.com
Cleartext-password := "password"	Remote access user password specified by the remote access user on the remote access client. This is required for AnyConnect EAP authentication.
Tunnel-Password = pre-shared-key-string	Pre-shared-key string to use for the remote access user. This is required for pre-shared key authentication.
cisco-avpair+="ip:interface-config=VRF forwarding VRF-name"	VRF (service VPN) that the remote access user is assigned to. Prerequisite: Define the VRF locally on the headend.
cisco-avpair+="ip:interface-config=IP unnumbered interface-name"	The IP unnumbered interface for the virtual-template and virtual-access interfaces. Prerequisite: On the SD-WAN RA headend, configure the interface to use for remote access, and a private IP address, preferably from the IP pool subnet range. The SD-WAN RA headend re-uses the private IP address described above for virtual-template and per-remote-access-user virtual-access interfaces. Note If the VRF attribute is configured in a RADIUS profile, then the IP numbered interface attribute must also be configured after the VRF attribute.
Framed-Pool=pool-name	Name of the IP pool, defined on the headend, that the remote access headend uses to assign an IP address to the remote access user.
cisco-avpair+="ipsec:route-set=prefix prefix/prefix-length"	IP prefixes to which the remote access user requires access over the remote access VPN tunnel. You can configure this attribute multiple times to specify multiple prefixes.
cisco-avpair+="ip:interface-config=cts role-based SGT-map SGT SGT-value"	The SGT to assign to the traffic from this remote access user that is destined to a Cisco Catalyst SD-WAN tunnel.

Table 2. Subset of the parameters in a user group profile
Parameter	Description
Group profile name	Domain portion of the remote access user identity. The group profile enables grouping of remote access users based on the domain portion of the remote access user identity. Grouping enables you to specify common policy parameters. Specifying example.com would include in the group any user with example.com domain after the @ character. The RADIUS server applies the parameters specified in this group profile to any users included in this group.
Cleartext-password := "password"	For an authorization request from remote access headend to the RADIUS server, the password is configured on the remote access headend as part of the authorization command in IKEv2 profile. If the password is not configured, the default password is cisco .
cisco-avpair+="ip:interface-config=VRF forwarding VRF-name"	VRF (service VPN) that the group of remote access users is assigned to. Prerequisite: Define the VRF locally on the headend.
cisco-avpair+="ip:interface-config=IP unnumbered interface-name"	The IP unnumbered interface for the virtual-template and virtual-access interfaces. Prerequisite: On the SD-WAN RA headend, configure the interface to use for remote access, and a private IP address, preferably from the IP pool subnet range. The SD-WAN RA headend re-uses the private IP address described above for virtual-template and per-remote-access-user virtual-access interfaces. Note If the VRF attribute is configured in a RADIUS profile, then the IP numbered interface attribute must also be configured after the VRF attribute.
Framed-Pool=pool-name	Name of the IP pool, defined on the headend, that the remote access headend uses to assign IP addresses to this group of remote access users.
cisco-avpair+="ipsec:route-set=prefix prefix/prefix-length"	IP prefixes to which the group of remote access users require access over the remote access VPN tunnel. You can configure this attribute multiple times to specify multiple prefixes.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.