RADIUS Client Configuration
Overview
Remote Authentication Dial In User Service (RADIUS) is a remote authentication protocol that is used to communicate with an authentication server.
A RADIUS server is responsible for receiving user connection requests, authenticating the user, and then returning all configuration information necessary for the client to deliver service to the user.
The key points for RADIUS authentication are:
• Transactions between client and server are authenticated through the use of a shared key and this key is never sent over the network.
• The password is encrypted before sending it over the network.
Note: As part of Radius Client, OcNOS supports authentication and accounting via Radius Server. Authorization is not supported.
RADIUS Server Authentication
RADIUS Server Host Configuration
Host
#configure terminal | Enter configure mode. |
(config)#radius-server login key testing101 vrf management | Specify the global key for radius servers that are not configured with their respective keys for management vrf. This key should match the one present in the config file of tacacs server. |
(config)#radius-server login key testing101 | Specify the global key for radius servers that are not configured with their respective keys for default vrf. This key should match the one present in the config file of tacacs server |
(config)#radius-server login host 10.16.19.2 vrf management seq-num 1 key 0 testing123 | Specify the radius server ipv4 address to be configured with shared local key for management vrf. The same key should be present on the server config file. |
(config)#radius-server login host 10.16.19.2 seq-num 1 key 0 testing123 | Specify the radius server ipv4 address to be configured with shared local key for default vrf. The same key should be present on the server config file. |
(config)#radius-server login host 10.12.30.86 vrf management seq-num 1 auth-port 1045 | Specify the radius server ipv4 address to be configured with port number for management vrf. The radius server should be started with same port number. |
(config)#radius-server login host 10.12.30.86 seq-num 1 auth-port 1045 | Specify the radius server ipv4 address to be configured with port number for default vrf.The radius server should be started with same port number |
(config)#radius-server login host 10.12.17.11 vrf management seq-num 1 key 7 wawyanb123 auth-port 60000 acct-port 60000 timeout 6 | Specify the radius server ipv4 address to be configured with authentication port number, accounting port number, shared key for management vrf. The radius server should be started with same port number. |
(config)#radius-server login host 10.12.17.11 seq-num 1 key 7 wawyanb123 auth-port 60000 acct-port 60000 timeout 6 | Specify the radius server ipv4 address to be configured with authentication port number, accounting port number, shared key for default vrf. The radius server should be started with same port number. The radius server should be started with same port number |
(config)#radius-server login host Radius-Server-1 vrf management seq-num 3 key 7 wawyanb123 auth-port 60000 acct-port 60000 timeout 2 | Specify the radius server configured with hostname, key authentication port number, accounting port number, for management VRF. The radius server should be started with same port number |
radius-server login host Radius-Server-1 seq-num 3 key 7 wawyanb123 auth-port 60000 acct-port 60000 timeout 2 | Specify the radius server configured with hostname sequence number, key and port number for default VRF. The radius server should be started with same port number. |
(config)#aaa authentication login default vrf management group radius | Enable authentication for radius server configured for management VRF. Authorization is also enabled by default |
(config)#aaa authentication login default group radius | Enable authentication for radius server configured for default vrf. Authorization is also enabled by default. |
(config)#aaa authentication login default vrf management group radius local | Enable authentication for radius server and fallback to local configured for management VRF. Authorization is also enabled by default |
(config)#aaa authentication login default group radius local | Enable authentication for radius server and fallback to local configured for default vrf. Authorization is also enabled by default |
(config)#aaa authentication login default vrf management group radius local none | Enable authentication for radius server, fallback to local followed by fallback to none, configured for management VRF. Authorization is also enabled by default |
(config)#aaa authentication login default radius local none | Enable authentication for radius server, fallback to local followed by fallback to none, configured for default vrf. Authorization is also enabled by default |
(config)#aaa authentication login default vrf management group radius none | Enable authentication for radius, fallback to none, configured for management VRF. Authorization is also enabled by default |
(config)#aaa authentication login default group radius none | Enable authentication for radius, fallback to none, configured for default VRF. Authorization is also enabled by default |
(config)#aaa group server radius G1 vrf management | Create aaa radius group G1 for management vrf |
(config)#aaa group server radius G1 | Create AAA radius group G1 for default VRF |
(config-radius)#server 10.12.30.86 | Make the radius server 10.12.30.86 a part of this group G1 for default VRF |
(config-radius)#server Radius-Server-1 | Make Radius-Server-1 a part of this group G1 |
(config-radius)#exit | Exit radius mode |
(config)#aaa group server radius G1 | Enter radius mode |
(config-radius)#server 10.12.30.86 | Make the radius server 10.12.30.86 a part of this group G1 for default vrf |
(config-radius)#server Radius-Server-1 | Make Radius-Server-1 a part of this group G1 |
(config)#exit | Exit radius mode. |
(config)#aaa authentication login default vrf management group G1 | Authenticate the tacacs+ group G1 with aaa authentication for management vrf |
(config)#aaa authentication login default group G1 | Authenticate the tacacs+ group G1 with aaa authentication for default vrf |
Validation
To verify the RADIUS authentication process, use SSH or Telnet from the host machine to Host IP with the authenticating user created, and provide a RADIUS server password and check whether the client validates the user with the corresponding username and password.
OcNOS#show radius-server vrf management
VRF: management
Global RADIUS shared secret: ********
timeout value: 5
Total number of servers:3
Following RADIUS servers are configured:
10.12.17.11:
available for authentication on port:60000
available for accounting on port:60000
timeout:6
RADIUS shared secret:********
10.12.30.86:
available for authentication on port:1045
available for accounting on port:1813
10.16.19.2:
available for authentication on port:1812
available for accounting on port:1813
RADIUS shared secret:********
#show radius-server vrf all
VRF: management
timeout value: 5
Total number of servers:2
Following RADIUS servers are configured:
100.0.0.1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
Radius-Server-1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
VRF: default
timeout value: 5
Total number of servers:2
Following RADIUS servers are configured:
Radius-Server-1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
100.0.0.1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
#show radius-server
VRF: default
timeout value: 5
Total number of servers:2
Following RADIUS servers are configured:
Radius-Server-1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
100.0.0.1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
#show radius-server vrf management sorted
VRF: management
timeout value: 5
Total number of servers:2
Following RADIUS servers are configured:
100.0.0.1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
Radius-Server-1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
#show radius-server vrf all sorted
VRF: management
timeout value: 5
Total number of servers:2
Following RADIUS servers are configured:
100.0.0.1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
Radius-Server-1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
VRF: default
timeout value: 5
Total number of servers:2
Following RADIUS servers are configured:
100.0.0.1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
Radius-Server-1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
#show radius-server sorted
VRF: default
timeout value: 5
Total number of servers:2
Following RADIUS servers are configured:
100.0.0.1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
Radius-Server-1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
#show radius-server vrf management groups
VRF: management
group radius:
server: all configured radius servers
group rad1:
server Radius-Server-1:
auth_port is 60000
acct_port is 60000
key is ********
server 100.0.0.1:
auth_port is 60000
acct_port is 60000
key is ********
#show radius-server vrf all groups
VRF: management
group radius:
server: all configured radius servers
group rad1:
server Radius-Server-1:
auth_port is 60000
acct_port is 60000
key is ********
server 100.0.0.1:
auth_port is 60000
acct_port is 60000
key is ********
VRF: default
group radius:
server: all configured radius servers
group rad1:
server Radius-Server-1:
auth_port is 60000
acct_port is 60000
key is ********
server 100.0.0.1:
auth_port is 60000
acct_port is 60000
key is ********
#show radius-server groups
VRF: default
group radius:
server: all configured radius servers
group rad1:
server Radius-Server-1:
auth_port is 60000
acct_port is 60000
key is ********
server 100.0.0.1:
auth_port is 60000
acct_port is 60000
key is ********
#show radius-server vrf management groups rad1
VRF: management
group rad1:
server Radius-Server-1
auth_port is 60000
acct_port is 60000
key is ********
server 100.0.0.1
auth_port is 60000
acct_port is 60000
key is ********
#show radius-server vrf all groups rad1
VRF: management
group rad1:
server Radius-Server-1
auth_port is 60000
acct_port is 60000
key is ********
server 100.0.0.1
auth_port is 60000
acct_port is 60000
key is ********
VRF: default
group rad1:
server Radius-Server-1
auth_port is 60000
acct_port is 60000
key is ********
server 100.0.0.1
auth_port is 60000
acct_port is 60000
key is ********
#show radius-server groups rad1
VRF: default
group rad1:
server Radius-Server-1
auth_port is 60000
acct_port is 60000
key is ********
server 100.0.0.1
auth_port is 60000
acct_port is 60000
key is ********
#show radius vrf management
VRF: management
timeout value: 5
Total number of servers:2
Following RADIUS servers are configured:
100.0.0.1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
Radius-Server-1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
#show radius vrf all
VRF: management
timeout value: 5
Total number of servers:2
Following RADIUS servers are configured:
100.0.0.1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
Radius-Server-1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
VRF: default
timeout value: 5
Total number of servers:2
Following RADIUS servers are configured:
Radius-Server-1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
100.0.0.1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
#show radius
VRF: default
timeout value: 5
Total number of servers:2
Following RADIUS servers are configured:
Radius-Server-1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
100.0.0.1:
available for authentication on port:60000
available for accounting on port:60000
RADIUS shared secret:********
#show aaa authentication vrf management
VRF: management
default: group radius
console: local
#show aaa authentication vrf all
VRF: management
default: group radius
console: local
VRF: default
default: group radius
console: local
#show aaa authentication
VRF: default
default: group radius
console: local
#show aaa groups vrf management
VRF: management
radius
rad1
rad1
#show aaa groups vrf all
VRF: management
radius
rad1
VRF: default
radius
rad1
#show aaa groups
VRF: default
radius
rad1
#show running-config radius
radius-server login host 100.0.0.1 vrf management seq-num 1 key 7 wawyanb123 auth-port 600
00 acct-port 60000
radius-server login host Radius-Server-1 vrf management seq-num 2 key 7 wawyanb123 auth-po
rt 60000 acct-port 60000
radius-server login host Radius-Server-1 seq-num 1 key 7 wawyanb123 auth-port 60000 acct-
port 60000
radius-server login host 100.0.0.1 seq-num 2 key 7 wawyanb123 auth-port 60000 acct-port 6
000
#show running-config aaa
aaa authentication login default vrf management group radius
aaa group server radius rad1 vrf management
server Radius-Server-1 vrf management
server 100.0.0.1 vrf management
aaa authentication login default group radius
aaa group server radius rad1
server Radius-Server-1
server 100.0.0.1
#show running-config aaa all
aaa authentication login default vrf management group radius
aaa accounting default vrf management local
no aaa authentication login default fallback error local vrf management
no aaa authentication login error-enable vrf management
aaa local authentication attempts max-fail 3
aaa local authentication unlock-timeout 1200
aaa group server radius rad1 vrf management
server Radius-Server-1 vrf management
server 100.0.0.1 vrf management
aaa authentication login default group radius
aaa accounting default local
no aaa authentication login default fallback error local
no aaa authentication login error-enable
aaa local authentication attempts max-fail 3
aaa local authentication unlock-timeout 1200
aaa group server radius rad1
server Radius-Server-1
server 100.0.0.1
RADIUS Server Accounting
You can configure accounting to measure the resources that another user consumes during access.
User
#configure terminal | Enter configure mode. |
(config)#radius-server login host 10.12.17.11 vrf management seq-num 1 key 7 wawyanb123 auth-port 60000 acct-port 60000 timeout 6 | Specify the radius server ipv4 address to be configured with authentication port number, accounting port number, shared key for management vrf. The radius server should be started with same port number. |
(config)#radius-server login host 10.12.17.11 seq-num 1 key 7 wawyanb123 auth-port 60000 acct-port 60000 timeout 6 | Specify the radius server ipv4 address to be configured with port number for default vrf.The radius server should be started with same port number |
(config)#aaa accounting default vrf management group radius | Enable accounting for radius server configured for vrf management |
(config)#aaa accounting default group radius | Enable accounting for radius server configured for default vrf |
Validation
#show aaa accounting vrf management
VRF: management
default: group radius
#show aaa accounting vrf all
VRF: management
default: group radius
VRF: default
default: group radius
#show aaa accounting
VRF: default
default: group radius
#
#show running-config aaa
aaa authentication login default vrf management group radius
aaa accounting default vrf management group radius
aaa group server radius rad1 vrf management
server Radius-Server-1 vrf management
server 100.0.0.1 vrf management
aaa authentication login default group radius
aaa accounting default group radius
aaa group server radius rad1
server Radius-Server-1
server 100.0.0.1
Sample Radius Clients.conf File
client 10.12.58.20 {
secret = testing123
shortname = localhost
}
client 192.168.1.2 {
secret = testing123
shortname = localhost
}
client 10.12.37.196 {
secret = testing123
}
client 100.0.0.2 {
secret = testing123
shortname = localhost
}
#IPv6 Client
#client ::1 {
#secret = testing123
#shortname = localhost
#}
#
#All IPv6 Site-local clients
#client fe80::/16 {
#secret = testing123
#shortname = localhost
Sample Radius Users Configuration File
#
#DEFAULT
#Service-Type = Login-User,
#Login-Service = Rlogin,
#Login-IP-Host = shellbox.ispdomain.com
##
##Last default: shell on the local terminal server.
##
#DEFAULT
#Service-Type = Administrative-User
#On no match, the user is denied access.
selftest Cleartext-Password := "password"
testuser1 Cleartext-Password := "user1@101"
testuser2 Cleartext-Password := "user2@202"
testuser3 Cleartext-Password := "user3@303"