1. On the Services > Security > AAA > Servers > RADIUS page, click Add.
2. Enter a name for the server and, and enter the IP address in the Server Address field.
3. In the Shared Secret field, enter the shared secret key to be used for authentication between the server and your device. Confirm the shared secret.
4. In the Auth Port and Acct Port fields, enter the RADIUS server’s UDP port numbers. The valid range is 1 to 65535, and the default value is 1812 for authentication and 1813 for accounting.
5. In the Server Timeout field, enter the number of seconds between retransmissions. The valid range is between 1 and 1000 seconds.
6. In the Retry Count field, enter the number of times the device can retry transmission.
7. If you are configuring a new RADIUS authentication server, choose Enabled from the Support for RFC 3576 drop-down list to enable RFC 3576, which is an extension to the RADIUS protocol that allows dynamic changes to a user session, or choose Disabled to disable this feature. RFC 3576 includes support for disconnecting users and changing authorizations applicable to a user session and supports disconnect and change-of-authorization (CoA) messages. Disconnect messages cause a user session to be terminated immediately where CoA messages modify session authorization attributes such as data filters.
8. Click Done and Apply.

For more information, see Configuring AAA Server Groups

1. On the Services > Security > AAA > Servers > TACACS+ page, click Add.
2. Enter a name for the server and, and enter the IP address in the Server Address field.
3. In the Shared Secret field, enter the shared secret key to be used for authentication between the server and your device. Confirm the shared secret.
4. In the Port field, enter the TACACS server’s UDP port number. The valid range is 1 to 65535, and the default value is 49.
5. In the Server Timeout field, enter the number of seconds between retransmissions. The valid range is between 1 and 1000 seconds.
6. Click Done and Apply.

For more information, see Configuring AAA Server Groups

1. On the Services > Security > AAA > Servers > LDAP page, click Add.
2. Enter a name for the server and, and enter the IP address in the Server Address field.
3. In the Port field, enter the LDAP server’s UDP port number. The valid range is 1 to 65535, and the default value is 389.
4. From the Simple Bind drop-down list, choose Anonymous or Authenticated to specify the local authentication bind method for the LDAP server. The Anonymous method allows anonymous access to the LDAP server. The Authenticated method requires that a username and password be entered to secure access. The default value is Anonymous.
5. If you chose Authenticated in the previous step, follow these steps:
   1. In the Bind Username field, enter a username to be used for local authentication to the LDAP server. The username can contain up to 80 characters. If the username starts with “cn=” (in lowercase letters), the controller assumes that the username includes the entire LDAP database path and does not append the user base DN. This designation allows the authenticated bind user to be outside the user base DN.
   2. In the Bind Username field, enter a username to be used for local authentication to the LDAP server. The username can contain up to 80 characters.
6. In the User Base DN field, enter the distinguished name (DN) of the subtree in the LDAP server that contains a list of all the users. For example, ou=organizational unit, .ou=next organizational unit, and o=corporation.com. If the tree containing users is the base DN, type. o=corporation.com, or dc=corporation, dc=com.
7. In the User Attribute field, enter the name of the attribute in the user record that contains the username. You can obtain this attribute from your directory server.
8. In the User Object Type field, enter the value of the LDAP objectType attribute that identifies the record as a user. Often, user records have several values for the objectType attribute, some of which are unique to the user and some of which are shared with other object types.
9. In the Server Timeout field, enter the number of seconds between retransmissions. The valid range is between 1 and 1000 seconds.
10. If you enable secure mode, configure a CA trustpoint on your device.
11. Click Done and Apply.

For more information, see Configuring AAA Server Groups.