RADIUS DTLS

RADIUS DTLS

RADIUS DTLS is a client or server protocol that

  • provides centralized security for users attempting to gain management access to a network

  • delivers a complete Authentication, Authorization, and Accounting (AAA) solution, and

  • uses RADIUS-over-DTLS (UDP) for secure communication.

RADIUS DTLS components and configuration

The Remote Authentication Dial-In User Service (RADIUS) is a widely deployed authentication and authorization protocol.

RADIUS DTLS includes these components:

  • RADIUS DTLS Port: Used for authentication and accounting with default DTLS server port 2083

  • Shared Secret: Uses RADIUS/DTLS as the shared secret when DTLS is enabled for a specific server

  • PAC Handling: Downloads PAC from ISE for CTS communication and encrypts CTS attributes with the PAC key

  • Session Management: Depends on DTLS server responses and closes sessions for ideal timeout or invalid responses

  • Load Balancing: Supports multiple DTLS servers and load balancing methods

You can change the RADIUS DTLS port number using DTLS port port_number . For more information, see the Configuring RADIUS DTLS Port Number section.

RADSEC consists of two types: RADIUS-over-TLS (using TCP) and RADIUS-over-DTLS (using UDP). Cisco IOS-XE support RADIUS-over-DTLS (UDP) but does not support RADIUS-over-TLS (TCP), as outlined in RFC 7360.

RADIUS DTLS timeout and retry configuration includes these parameters:

  • Connection Timeout: Default connection timeout is 5 seconds

  • Connection Retries: Default connection retries is 5

  • Idle Timeout: Default idle timeout is 60 seconds

After the encrypted RADIUS packet is sent, you need to start the retransmission timer. If you do not get a response before the retransmission timer expires, the packet is re-encrypted and re-transmitted. You can continue for number of times as per the DTLS retries configuration or till the default value. Once the number of tries exceeds the limit, the server becomes unavailable and responses are sent back to the AAA clients.

As the RADIUS DTLS is UDP based, you need to retry the connection after a specific timeout interval for a specific number of retries. After all retries are exhausted, the DTLS connection performs these actions:

  • Is marked as unsuccessful.

  • Looks up for the next available server for processing the RADIUS requests.

When the idle timer expires and no transactions exists since the last idle timeout, the DTLS session remains closed. After you establish the DTLS session, you can start the idle timer. If you start the idle timer for 30 seconds and one of the RADIUS DTLS packet is sent, then after 30 seconds, the idle timer expires and checks for number of RADIUS DTLS transactions. If the idle timer value exceeds zero, the idle timer resets the transaction counter and restarts the timer.

You can configure RADIUS servers with and without DTLS. It is recommended to create AAA server groups with DTLS enabled servers and non-DTLS servers. However, you will not find any such restriction while configuring AAA server groups.

Suppose you choose a DTLS server, the DTLS server establishes connection and RADIUS request packet is sent to the DTLS server. If the DTLS server does not respond after all RADIUS retries, it would fall over to the next configured server in the same server group. If the next server is a DTLS server, the processing of the RADIUS request packet continues with the next server. If the next server is a non-DTLS server, the processing of RADIUS request packet does not happen in that server group. Then the server group failover occurs and the same sequence continues with the next server group, if the next server group is available.


Note

You need to use either only DTLS or non-DTLS servers in a server group.

Requirement: Port RADIUS DTLS support to BINOS platforms

Support for IOS and BINOS AAA

Port RADIUS DTLS support to BINOS after completing implementation in IOS, since the AAA server runs on both IOS and BINOS platforms.

Configure RADIUS DTLS server (CLI)

Enable secure RADIUS communication using DTLS encryption on a wireless controller.
DTLS (Datagram Transport Layer Security) provides secure communication for RADIUS authentication in wireless networks. This configuration is used to protect RADIUS traffic between the wireless controller and RADIUS server.

Procedure

Step 1

Enter privileged EXEC mode.

Example:

Device# enable

Step 2

Enter global configuration mode.

Example:

Device# configure terminal

Step 3

Specify the RADIUS server name.

Example:

Device(config)# radius server server-name

Example:

Device(config)# radius server R1

Step 4

Configure DTLS parameters.

Example:

Device(config-radius-server)# dtls

Step 5

Return to privileged EXEC mode.

Example:

Device(config-radius-server)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The RADIUS server is now configured with DTLS security, enabling encrypted communication for authentication requests.

Configure RADIUS DTLS connection timeout

Set the timeout value for DTLS connections to RADIUS servers to ensure proper connection management and security.
DTLS (Datagram Transport Layer Security) connection timeout configuration is necessary when using encrypted communication between the wireless controller and RADIUS servers. This setting determines how long the controller waits before timing out a DTLS connection attempt.
Procedure

Step 1

Enter privileged EXEC mode.

Example:
Device# enable

Step 2

Enter global configuration mode.

Example:
Device# configure terminal

Step 3

Specify the RADIUS server name.

Example:
Device(config)# radius server server-name
Example:
Device(config)# radius server R1

Step 4

Configure RADIUS DTLS connection timeout.

Example:
Device(config-radius-server)# dtls connectiontimeout timeout-value
Example:
Device(config-radius-server)# dtls connectiontimeout 1

The timeout-value refers to the DTLS connection timeout value. The valid range is from 1 to 65535.

Step 5

Return to privileged EXEC mode.

Example:
Device(config-radius-server)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The RADIUS DTLS connection timeout is now configured with the specified timeout value for the designated RADIUS server.

Configure RADIUS DTLS idle timeout

Set up RADIUS DTLS idle timeout to control the duration before idle DTLS connections are terminated.
RADIUS DTLS idle timeout configuration is necessary to manage connection resources and ensure proper cleanup of inactive DTLS sessions between the wireless controller and RADIUS server.
Procedure

Step 1

Enter privileged EXEC mode.

Example:
Device# enable

Step 2

Enter global configuration mode.

Example:
Device# configure terminal

Step 3

Specify the RADIUS server name.

Example:
Device(config)# radius server server-name
Example:
Device(config)# radius server R1

Step 4

Configure RADIUS DTLS idle timeout.

Example:
Device(config-radius-server)# dtls idletimeout idle-timeout-value
Example:
Device(config-radius-server)# dtls idletimeout 2

The DTLS idle timeout value valid range is from 1 to 65535.

Step 5

Return to privileged EXEC mode.

Example:
Device(config-radius-server)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The RADIUS DTLS idle timeout is configured and will terminate idle DTLS connections after the specified timeout period.

Configure source interface for RADIUS DTLS server

Configure the source interface for RADIUS DTLS server to establish secure communication between the wireless controller and RADIUS server.
When configuring RADIUS authentication with DTLS encryption, you need to specify the source interface that the wireless controller will use to communicate with the RADIUS server. This ensures proper routing and security for authentication traffic.
Procedure

Step 1

Enter privileged EXEC mode.

Example:
Device# enable

Step 2

Enter global configuration mode.

Example:
Device# configure terminal

Step 3

Specify the RADIUS server name.

Example:
Device(config)# radius server server-name
Example:
Device(config)# radius server R1

Step 4

Configure source interface for RADIUS DTLS server.

Example:
Device(config-radius-server)# dtls ip radius source-interface Ethernet-Internal interface-number
Example:
Device(config-radius-server)# dtls ip radius source-interface Ethernet-Internal 0

The interface-number refers to the Ethernet-Internal interface number. The default value is 0.

Step 5

Return to privileged EXEC mode.

Example:
Device(config-radius-server)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The source interface for RADIUS DTLS server is now configured, enabling secure RADIUS communication through the specified Ethernet-Internal interface.

Configure RADIUS DTLS port number (CLI)

Configure the RADIUS DTLS port number to establish secure RADIUS communication using DTLS protocol.
RADIUS DTLS provides secure authentication and accounting communication between the wireless controller and RADIUS server. Configure the DTLS port when you need to specify a custom port number for DTLS communication.
Procedure

Step 1

Enter privileged EXEC mode.

Example:
Device# enable

Step 2

Enter global configuration mode.

Example:
Device# configure terminal

Step 3

Specify the RADIUS server name.

Example:
Device(config)# radius server server-name
Example:
Device(config)# radius server R1

Step 4

Configure RADIUS DTLS port number.

Example:
Device(config-radius-server)# dtls port port-number
Example:
Device(config-radius-server)# dtls port 2

The port-number refers to the DTLS port number.

Step 5

Return to privileged EXEC mode.

Example:
Device(config-radius-server)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The RADIUS DTLS port number is configured and the controller can now use the specified port for secure DTLS communication with the RADIUS server.

Configure RADIUS DTLS connection retries (CLI)

Set the number of RADIUS DTLS connection retry attempts to ensure reliable authentication server connectivity.
RADIUS DTLS connection retries help maintain authentication service availability when network conditions cause connection failures. Configure this setting when you need to control how many times the wireless controller attempts to reconnect to the RADIUS server before giving up.
Procedure

Step 1

Enter privileged EXEC mode.

Example:
Device# enable

Step 2

Enter global configuration mode.

Example:
Device# configure terminal

Step 3

Specify the RADIUS server name.

Example:
Device(config)# radius server server-name
Example:
Device(config)# radius server R1

Step 4

Configure RADIUS connection retries.

Example:
Device(config-radius-server)# dtls retries retry-number
Example:
Device(config-radius-server)# dtls retries 3

The retry-number refers to the DTLS connection retries. The valid range is from 1 to 65535.

Step 5

Return to privileged EXEC mode.

Example:
Device(config-radius-server)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The RADIUS DTLS connection retry count is configured and the wireless controller will attempt the specified number of reconnections before failing over or giving up.

Configure RADIUS DTLS trustpoint (CLI)

Establish secure DTLS communication between the wireless controller and RADIUS server by configuring appropriate trustpoints for authentication.
RADIUS DTLS trustpoints provide secure communication channels for RADIUS authentication traffic. Configure both client and server trustpoints to ensure proper certificate validation during DTLS handshakes.
Procedure

Step 1

Enter privileged EXEC mode.

Example:
Device# enable

Step 2

Enter global configuration mode.

Example:
Device# configure terminal

Step 3

Specify the RADIUS server name.

Example:
Device(config)# radius server server-name
Example:
Device(config)# radius server R1

Step 4

Configure trustpoint for client and server.

Example:
Device(config-radius-server)# dtls trustpoint client client-trustpoint-name dtls
Example:
Device(config-radius-server)# dtls trustpoint server server-trustpoint-name dtls
Example:
Device(config-radius-server)# dtls trustpoint client client1 dtls
Example:
Device(config-radius-server)# dtls trustpoint server server1 dtls

Step 5

Return to privileged EXEC mode.

Example:
Device(config-radius-server)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The RADIUS DTLS trustpoints are now configured, enabling secure DTLS communication between the wireless controller and RADIUS server for authentication traffic.

Configure RADIUS DTLS match-server-identity

This task configures RADIUS DTLS match-server-identity parameters to establish secure authentication between the wireless controller and RADIUS server.

RADIUS DTLS (Datagram Transport Layer Security) provides encrypted communication for RADIUS authentication. The match-server-identity feature validates the RADIUS server's certificate against its hostname or IP address to ensure secure connections.

Procedure

Step 1

Configure the RADSEC certification validation parameters.

Example:
dtls match-server-identity hostname <name>

Step 2

Configure the RADSEC certification validation parameters.

Example:
dtls match-server-identity ip-address <IPv4 or IPv6>

The RADIUS DTLS match-server-identity parameters are configured, enabling secure certificate validation for RADSEC communication.

Configure DTLS Dynamic Author (CLI)

Enable DTLS support for RADIUS dynamic authorization (RFC 3576) on the wireless controller.
DTLS Dynamic Author provides secure communication for RADIUS Change of Authorization (CoA) and disconnect messages. This configuration is needed when implementing dynamic policy changes and session management in wireless networks.

Procedure

Step 1

Enter privileged EXEC mode.

Example:

Device# enable

Step 2

Enter global configuration mode.

Example:

Device# configure terminal

Step 3

Configure local server profile for RFC 3576 support.

Example:

Device(config)# aaa server radius dynamic-author

Step 4

Configure DTLS source parameters.

Example:

Device(config-locsvr-da-radius)# dtls

Step 5

Return to privileged EXEC mode.

Example:

Device(config-locsvr-da-radius)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

DTLS Dynamic Author is now configured on the wireless controller, enabling secure RADIUS dynamic authorization communications.

Enable DTLS for client (CLI)

Enable DTLS encryption for client communications to secure RADIUS dynamic authorization messages.
DTLS (Datagram Transport Layer Security) provides encryption for UDP-based communications between the wireless controller and RADIUS clients. This configuration enhances security for RFC 3576 dynamic authorization operations.

Procedure

Step 1

Enter privileged EXEC mode.

Example:

Device# enable

Step 2

Enter global configuration mode.

Example:

Device# configure terminal

Step 3

Configure local server profile for RFC 3576 support.

Example:

Device(config)# aaa server radius dynamic-author

Step 4

Enable DTLS for the client.

Example:

Device(config-locsvr-da-radius)# client IP-address dtls

Example:

Device(config-locsvr-da-radius)# client 10.104.49.14 dtls

Step 5

Return to privileged EXEC mode.

Example:

Device(config-locsvr-da-radius)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

DTLS is now enabled for the specified client, providing encrypted communication for RADIUS dynamic authorization messages.

Configure client trustpoint for DTLS (CLI)

Establish secure DTLS communication between the wireless controller and RADIUS dynamic authorization clients.
Client trustpoint configuration for DTLS is required when implementing secure communication for RFC 3576 dynamic authorization services on wireless controllers.
Procedure

Step 1

Enter privileged EXEC mode.

Example:
Device# enable

Step 2

Enter global configuration mode.

Example:
Device# configure terminal

Step 3

Configure local server profile for RFC 3576 support.

Example:
Device(config)# aaa server radius dynamic-author

Step 4

Configure client trustpoint for DTLS.

Example:
Device(config-locsvr-da-radius)# client IP-address dtls client-tp client-tp-name
Example:
Device(config-locsvr-da-radius)# client 10.104.49.14 dtls client-tp client_tp_name

Step 5

Return to privileged EXEC mode.

Example:
Device(config-locsvr-da-radius)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The client trustpoint for DTLS is now configured, enabling secure communication between the wireless controller and the specified RADIUS dynamic authorization client.

Configure DTLS idle timeout (CLI)

Set the DTLS idle timeout interval to control when inactive DTLS connections are terminated.
DTLS idle timeout configuration is necessary to manage inactive DTLS connections and optimize resource utilization on wireless controllers.
Procedure

Step 1

Enter privileged EXEC mode.

Example:
Device# enable

Step 2

Enter global configuration mode.

Example:
Device# configure terminal

Step 3

Configure local server profile for RFC 3576 support.

Example:
Device(config)# aaa server radius dynamic-author

Step 4

Configure DTLS idle time.

Example:
Device(config-locsvr-da-radius)# client IP_addr dtls idletimeout timeout-interval  {client-tp client_tp_name | server-tp server_tp_name} client IP-address dtls idletimeout timeout-interval client-tp client-tp-name
Example:
Device(config-locsvr-da-radius)# client 10.104.49.14 dtls idletimeout 62 client-tp dtls_ise

The timeout-interval refers to the idle timeout interval. The valid range is from 60 to 600.

Step 5

Return to privileged EXEC mode.

Example:
Device(config-locsvr-da-radius)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The DTLS idle timeout is now configured and will terminate inactive DTLS connections after the specified timeout interval.

Configure server trustpoint for DTLS (CLI)

Enable secure DTLS communication between the wireless controller and RADIUS clients by configuring a server trustpoint.
Server trustpoints are required when implementing DTLS (Datagram Transport Layer Security) for RFC 3576 Change of Authorization (CoA) messages between RADIUS clients and the wireless controller. This ensures encrypted and authenticated communication.
Procedure

Step 1

Enter privileged EXEC mode.

Example:
Device# enable

Step 2

Enter global configuration mode.

Example:
Device# configure terminal

Step 3

Configure local server profile for RFC 3576 support.

Example:
Device(config)# aaa server radius dynamic-author

Step 4

Configure server trust point for the DTLS client.

Example:
Device(config-locsvr-da-radius)# client IP-address dtls server-tp server-trustpoint-name
Example:
Device(config-locsvr-da-radius)# client 10.104.49.14 dtls server-tp dtls_client

Step 5

Return to privileged EXEC mode.

Example:
Device(config-locsvr-da-radius)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The server trustpoint for DTLS is now configured, enabling secure communication between the wireless controller and the specified RADIUS client for Change of Authorization messages.

Verify RADIUS DTLS server configuration

To view information about the DTLS enabled servers, use this command:

Device# show aaa servers
DTLS: Packet count since last idletimeout 1,
Send handshake count 3,
Handshake Success 1,
Total Packets Transmitted 1,
Total Packets Received 1,
Total Connection Resets 2,
Connection Reset due to idle timeout 0,
Connection Reset due to No Response 2,
Connection Reset due to Malformed packet 0,

Clear RADIUS DTLS specific statistics

Clear RADIUS DTLS specific statistics to reset monitoring counters and start fresh data collection.

Use this task when you need to reset DTLS server statistics for monitoring purposes or troubleshooting.

Procedure

Clear the RADIUS DTLS specific statistics.

Example:

Device# clear aaa counters servers radius {<server-id> | all}

Note

 

Here, server-ID refers to the server ID displayed by show aaa servers . The valid range is from 0 to 2147483647.

The RADIUS DTLS specific statistics are cleared and reset to zero.