OcNOS SP : System Management Guide : Authentication Management Configuration : RADIUS Client Configuration
RADIUS Client Configuration
Overview
Remote Authentication Dial In User Service (RADIUS) is a remote authentication protocol that is used to communicate with an authentication server. A RADIUS server is responsible for receiving user connection requests, authenticating the user, and then returning all configuration information necessary for the client to deliver service to the user.
The OcNOS device, acting as a RADIUS client, sends the user’s credentials to the RADIUS server requesting authentication. The RADIUS server validates the received user’s credentials and authenticates it. After the authentication, it authorizes the user’s privilege level and shares it with the OcNOS. Thus, the user role is decided based on the received privilege level.
The key points for RADIUS authentication are:
Transactions between client and server are authenticated through the use of a shared key and this key is never sent over the network.
The password is encrypted before sending it over the network.
A maximum of eight RADIUS servers can be configured.
Limitation:
If the privilege level is not specified in the radius server’s user config file, the default role is considered “network-user.”
By default, the Privileged Exec mode is given to all the users
In OcNOS version 6.4.1, the RADIUS is not present on radius server or authentication fails from RADIUS server
To implement the above requirements, the existing CLI aaa authentication login default fallback error is used to enable fallback to local authentication server. This is disabled by default.
By default, the fallback to local authentication is applied when the Radius server is unreachable. For other scenarios, enable the fallback using the CLI.
Note: For invalid secret key there is no fallback local authentication.
Console authentication is not supported for Radius.
In OcNOS version 6.4.2, the RADIUS Authorization is supported.
RADIUS Authorization Configuration
Benefits
Based on the privilege level received from the RADIUS server user role is determined.
Prerequisites
RADIUS server process must be up and running.
Configuration
Topology
Following is the RADIUS client and server network topology.
RADIUS Server Client Configuration
IPv4 Address
RADIUS server address is configured in IPv4 address format.
RADIUS Client (Host)
 
(config)#radius-server login host 10.12.33.211 vrf management seq-num 1 key 0 testing123
Specify the radius server ipv4 address to be configured with shared local key for management vrf. The same key should be present on the server config file.
(config)#radius-server login host 1.1.1.2 seq-num 1 key 0 testing123
Specify the radius server ipv4 address to be configured with shared local key for default vrf. The same key should be present on the server config file.
(config)#aaa authentication login default vrf management group radius
Enable authentication for radius server configured for management VRF. Authorization is also enabled by default.
(config)#aaa authentication login console group radius
Enable authentication for radius server . Authorization is also enabled by console
(config)#aaa authentication login default vrf management group radius local
Enable authentication for radius server and fallback to local configured for management VRF. Authorization is also enabled by default
(config)#aaa authentication login console group radius local
Enable authentication for radius server and fallback to local configured for default vrf. Authorization is also enabled by default
Specifies privilege level in radius server configuration file. The RADIUS client fetch the network operator privilege level from this file. The Privilege level range is between 0-15.
Table P-8: Role/privilege level mapping
Role
Privilege level
Network-admin
15
Network-engineer
14
RBAC-customized-role
13
Network-operator
1 to 12
Network-user
0 or any other values (>15 or negative values or any character)
 
Validation
To verify the RADIUS authorization process, login from the host machine to Host IP with the authenticating user credentials and provide a RADIUS server password.
Execute following show commands to verify the Radius authorization status.
 
OcNOS#sh running-config aaa
aaa authentication login default vrf management group radius
aaa authentication login console group radius
aaa authentication login default vrf management group radius local
aaa authentication login console group radius local
 
OcNOS#sh running-config radius
radius-server login host 10.12.33.211 vrf management seq-num 1 key 7 0x67efdb4ad9d771c3ed8312b2bc74cedb
 
radius-server login host 1.1.1.1 seq-num 1 key 7 0x67efdb4ad9d771c3ed8312b2bc74cedb
 
OcNOS#sh radius-server vrf management
timeout value: 5
 
Total number of servers:1
 
VRF: management
Following RADIUS servers are configured:
Radius Server : 10.12.33.211 (*)
Sequence Number : 1
available for authentication on port : 1812
available for accounting on port : 1813
RADIUS shared secret : ********
Failed Authentication count : 3
Successful Authentication count : 13
Failed Connection Request : 3
Last Successful authentication : 2023 November 30, 06:25:07
 
OcNOS#sh radius-server vrf management
timeout value: 5
 
Total number of servers:1
 
VRF: management
Following RADIUS servers are configured:
Radius Server : 1.1.1.1 (*)
Sequence Number : 1
available for authentication on port : 1812
available for accounting on port : 1813
RADIUS shared secret : ********
Failed Authentication count : 3
Successful Authentication count : 10
Failed Connection Request : 0
Last Successful authentication : 2023 November 30, 06:28:07
 
 
OcNOS#sh users
Current user : (*). Lock acquired by user : (#).
CLI user : [C]. Netconf users : [N].
Location : Applicable to CLI users.
Session : Applicable to NETCONF users.
 
Line User Idle Location/Session PID TYPE Role
(*) 0 con 0 [C]ocnos 0d00h00m ttyS0 5251 Local network-admin
130 vty 0 [C]ocnos 0d00h00m pts/0 5288 Remote network-user
131 vty 1 [C]abc 0d00h00m pts/1 5340 Remote network-engineer
132 vty 2 [C]ipi 0d00h00m pts/2 5350 Remote network-operator
IPv6 Address
RADIUS server address is configured in IPv6 address.
RADIUS Client (Host)
 
OcNOS(config)#radius-server login host 2001:db8:100::2 vrf management seq-num 1 key 0 testing123
Configure radius server with IPv6 address
OcNOS(config)#aaa authentication login default vrf management group radius local
Configure AAA authentication
(config)#interface eth0
Navigate to the interface mode
(config-if)#ipv6 address 2001:db8:100::5/64
Configure IPv6 address on the eth0 interface
(config-if)#exit
Exit interface configure mode
(config)#commit
Commit the configuration
(config)#exit
Exit configure mode
Validation
To verify the RADIUS authorization process, login from the host machine to Host IP with the authenticating user credentials and provide a RADIUS server password.
Execute following show commands to verify the Radius authorization status.
#show running-config radius
radius-server login host 2001:db8:100::2 vrf management seq-num 1 key 7 0x67efdb4ad9d771c3ed8312b2bc74cedb
 
#show running-config aaa
aaa authentication login default vrf management group radius
 
#show ipv6 interface eth0 brief
Interface IPv6-Address Admin-Status
eth0 2001:db8:100::5fe80::218:23ff:fe30:e6ba [up/up]
Implementation Examples
Following is an example for radius-server configuration file:
ipi Cleartext-Password := "ipi123"
Management-Privilege-Level := 12
ocnos Cleartext-Password := "ocnos"
Management-Privilege-Level := 0
abc Cleartext-password :="AC123"
Management-Privilege-Level := 14
 
 
RADIUS Server Authentication Configuration
 
IPv4 Address
Radius server address is configured as IPv4 address.
Topology
 
RADIUS Server Host Configuration
Host
 
#configure terminal
Enter configure mode.
(config)#radius-server login key testing101 vrf management
Specify the global key for radius servers that are not configured with their respective keys for management vrf. This key should match the one present in the config file of tacacs server.
(config)#radius-server login key testing101
Specify the global key for radius servers that are not configured with their respective keys for default vrf. This key should match the one present in the config file of tacacs server
(config)#radius-server login host 10.12.17.13 vrf management seq-num 1 key testing123
Specify the radius server ipv4 address to be configured with shared local key for management vrf. The same key should be present on the server config file.
(config)#radius-server login host 10.12.17.13 seq-num 2 key testing123
Specify the radius server ipv4 address to be configured with shared local key for default vrf. The same key should be present on the server config file.
(config)#radius-server login host 10.12.17.11 vrf management seq-num 1 auth-port 1045
Specify the radius server ipv4 address to be configured with port number for management vrf. The radius server should be started with same port number.
(config)#radius-server login host 10.12.17.11 seq-num 1 auth-port 1045
Specify the radius server ipv4 address to be configured with port number for default vrf. The radius server should be started with same port number
(config)#radius-server login host 10.12.17.11 vrf management seq-num 1 key 7 wawyanb123 auth-port 60000 acct-port 60000 timeout 6
Specify the radius server ipv4 address to be configured with authentication port number, accounting port number, shared key for management vrf. The radius server should be started with same port number.
(config)#radius-server login host 10.12.17.11 seq-num 1 key 7 wawyanb123 auth-port 60000 acct-port 60000 timeout 6
Specify the radius server ipv4 address to be configured with authentication port number, accounting port number, shared key for default vrf. The radius server should be started with same port number. The radius server should be started with same port number
(config)#radius-server login host Radius-Server-1 vrf management seq-num 2 key 7 wawyanb123 auth-port 60000 acct-port 60000 timeout 2
Specify the radius server configured with hostname, key authentication port number, accounting port number, for management VRF. The radius server should be started with same port number
(config)#radius-server login host Radius-Server-1 seq-num 2 key 7 wawyanb123 auth-port 60000 acct-port 60000 timeout 2
Specify the radius server configured with hostname sequence number, key and port number for default VRF. The radius server should be started with same port number.
(config)#aaa authentication login default vrf management group radius
Enable authentication for radius server configured for management VRF. Authorization is also enabled by default
(config)#aaa authentication login default group radius
Enable authentication for radius server configured for default vrf. Authorization is also enabled by default.
(config)#aaa authentication login default vrf management group radius local
Enable authentication for radius server and fallback to local configured for management VRF. Authorization is also enabled by default
(config)#aaa authentication login default group radius local
Enable authentication for radius server and fallback to local configured for default vrf. Authorization is also enabled by default
(config)#aaa authentication login default vrf management group radius local none
Enable authentication for radius server, fallback to local followed by fallback to none, configured for management VRF. Authorization is also enabled by default
(config)#aaa authentication login default radius local none
Enable authentication for radius server, fallback to local followed by fallback to none, configured for default vrf. Authorization is also enabled by default
(config)#aaa authentication login default vrf management group radius none
Enable authentication for radius, fallback to none, configured for management VRF. Authorization is also enabled by default
(config)#aaa authentication login default group radius none
Enable authentication for radius, fallback to none, configured for default VRF. Authorization is also enabled by default
(config)#aaa group server radius G1 vrf management
Create aaa radius group G1 for management vrf
(config)#aaa group server radius G1
Create AAA radius group G1 for default VRF
(config-radius)#server 10.12.17.11
Make the radius server 10.12.30.86 a part of this group G1 for default VRF
(config-radius)#server Radius-Server-1
Make Radius-Server-1 a part of this group G1
(config-radius)#exit
Exit radius mode
(config)#commit
Commit the configuration
(config)#aaa group server radius G1
Enter radius mode
(config-radius)#server 10.12.17.11
Make the radius server 10.12.30.86 a part of this group G1 for default vrf
(config-radius)#server Radius-Server-1
Make Radius-Server-1 a part of this group G1
(config-radius)#exit
Exit radius mode.
(config)#commit
Commit the configuration
(config)#aaa authentication login default vrf management group G1
Authenticate the tacacs+ group G1 with aaa authentication for management vrf
(config)#aaa authentication login default group G1
Authenticate the tacacs+ group G1 with aaa authentication for default vrf
(config)#commit
Commit the configuration
Validation
To verify the RADIUS authentication process, use SSH or Telnet from the host machine to Host IP with the authenticating user created, and provide a RADIUS server password and check whether the client validates the user with the corresponding username and password.
#show radius-server vrf management
VRF: management
timeout value: 5
 
Total number of servers:2
 
Following RADIUS servers are configured:
Radius Server : 10.12.17.13
Sequence Number : 1
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
RADIUS shared secret : ********
Failed Authentication count : 0
Successful Authentication count : 2
Failed Connection Request : 2
Last Successful authentication : 2000 January 05, 20:55:44
Radius Server : 10.12.17.11 (*)
Sequence Number : 2
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
RADIUS shared secret : ********
Failed Authentication count : 1
Successful Authentication count : 1
Failed Connection Request : 0
Last Successful authentication : 2000 January 05, 20:58:33
 
#show radius-server
VRF: default
timeout value: 5
 
Total number of servers:4
 
Following RADIUS servers are configured:
Radius Server : 192.168.1.1
Sequence Number : 1
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
RADIUS shared secret : ********
Failed Authentication count : 0
Successful Authentication count : 1
Failed Connection Request : 2
Last Successful authentication : 2000 January 05, 20:45:09
 
Radius Server : 100.0.0.1 (*)
Sequence Number : 2
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
 
Radius Server : 100.0.0.1 (*)
Sequence Number : 2
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
RADIUS shared secret : ********
Failed Authentication count : 1
Successful Authentication count : 1
Failed Connection Request : 0
Last Successful authentication : 2000 January 05, 20:46:36
 
#show radius-server vrf management
VRF: management
timeout value: 5
 
Total number of servers:2
 
Following RADIUS servers are configured:
Radius Server : 10.12.17.13
Sequence Number : 1
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
RADIUS shared secret : ********
Failed Authentication count : 0
Successful Authentication count : 2
Failed Connection Request : 2
Last Successful authentication : 2000 January 05, 20:55:44
Radius Server : 10.12.17.11 (*)
Sequence Number : 2
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
RADIUS shared secret : ********
Failed Authentication count : 1
Successful Authentication count : 1
Failed Connection Request : 0
Last Successful authentication : 2000 January 05, 20:58:33
 
#show radius-server
VRF: default
timeout value: 5
 
Total number of servers:4
 
Following RADIUS servers are configured:
Radius Server : 192.168.1.1
Sequence Number : 1
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
RADIUS shared secret : ********
Failed Authentication count : 0
Successful Authentication count : 1
Failed Connection Request : 2
Last Successful authentication : 2000 January 05, 20:45:09
 
Radius Server : 100.0.0.1 (*)
Sequence Number : 2
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
 
Radius Server : 100.0.0.1 (*)
Sequence Number : 2
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
RADIUS shared secret : ********
Failed Authentication count : 1
Successful Authentication count : 1
Failed Connection Request : 0
Last Successful authentication : 2000 January 05, 20:46:36
 
#show radius-server vrf all
VRF: management
timeout value: 5
 
Total number of servers:2
 
Following RADIUS servers are configured:
Radius Server : 10.12.17.13
Sequence Number : 1
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
RADIUS shared secret : ********
Failed Authentication count : 0
Successful Authentication count : 2
Failed Connection Request : 2
Last Successful authentication : 2000 January 05, 20:55:44
Radius Server : 10.12.17.11 (*)
Sequence Number : 2
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
RADIUS shared secret : ********
Failed Authentication count : 1
Successful Authentication count : 1
Failed Connection Request : 0
Last Successful authentication : 2000 January 05, 20:58:33
 
VRF: default
timeout value: 5
 
Total number of servers:4
 
Following RADIUS servers are configured:
Radius Server : 192.168.1.1
Sequence Number : 1
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
RADIUS shared secret : ********
Failed Authentication count : 0
Successful Authentication count : 1
Failed Connection Request : 2
Last Successful authentication : 2000 January 05, 20:45:09
 
Radius Server : 100.0.0.1 (*)
Sequence Number : 2
available for authentication on port : 60000
available for accounting on port : 60000
timeout : 2
RADIUS shared secret : ********
Failed Authentication count : 1
Successful Authentication count : 1
Failed Connection Request : 0
Last Successful authentication : 2000 January 05, 20:46:36
 
#show running-config radius
radius-server login key 7 0x6f32ba3f9e05a3db vrf management
radius-server login host 10.12.17.13 vrf management seq-num 1 key 7 0x67efdb4ad9d771c3ed8312b2bc74cedb
 
#show running-config aaa
aaa authentication login default vrf management group radius
aaa group server radius rad1 vrf management
server Radius-Server-1 vrf management
server 100.0.0.1 vrf management
 
aaa authentication login default group radius
aaa group server radius rad1
server Radius-Server-1
server 100.0.0.1
 
#show running-config aaa all
aaa authentication login default vrf management group radius
aaa authentication login console local
aaa accounting default vrf management local
no aaa authentication login default fallback error local vrf management
no aaa authentication login console fallback error local
no aaa authentication login error-enable vrf management
aaa local authentication attempts max-fail 3
aaa local authentication unlock-timeout 1200
aaa group server radius rad1 vrf management
server Radius-Server-1 vrf management
server 100.0.0.1 vrf management
 
aaa authentication login default group radius
aaa authentication login console local
aaa accounting default local
no aaa authentication login default fallback error local
no aaa authentication login console fallback error local
no aaa authentication login error-enable
aaa local authentication attempts max-fail 3
aaa local authentication unlock-timeout 1200
aaa group server radius rad1
server Radius-Server-1
server 100.0.0.1
IPv6 Address
Radius server address is configured as IPv6 address. Authentication messages are transmitted to radius server from the Router using IPv6 address.
Topology
Figure 3-3 shows the sample configuration of Radius server.
RADIUS topology
R1
 
#configure terminal
Enter configure mode.
(config)#radius-server login host 2001:db8:100::2 vrf management seq-num 1 key 0 testing123
Configure radius server with IPv6 address
(config)#aaa authentication login default vrf management group radius
Configure AAA authentication
(config)#aaa authentication login error-enable vrf management
Configure AAA authentication login error-enable
(config)#interface eth0
Navigate to the interface mode
(config-if)#ipv6 address 2001:db8:100::5/64
Configure IPv6 address on the eth0 interface
(config-if)#exit
Exit interface configure mode
(config)#commit
Commit the configuration
(config)#exit
Exit configure mode
Validation
Perform TELNET to the Router R1. Provide the username mentioned in the radius server "users" file as telnet username. Check that R1 sends radius request to the radius server using IPv6 address.
#show running-config radius
radius-server login host 2001:db8:100::2 vrf management seq-num 1 key 7 0x67efdb
4ad9d771c3ed8312b2bc74cedb
 
#show running-config aaa
aaa authentication login default vrf management group radius
aaa authentication login error-enable vrf management
 
#show ipv6 interface eth0 brief
Interface IPv6-Address Admin-Sta
tus
eth0 2001:db8:100::5
fe80::218:23ff:fe30:e6ba [up/up]
RADIUS Server Accounting
You can configure accounting to measure the resources that another user consumes during access.
User
 
#configure terminal
Enter configure mode.
(config)#radius-server login host 10.12.17.11 vrf management key 7 seq-num 1 wawyanb123 auth-port 60000 acct-port 60000 timeout 6
Specify the radius server ipv4 address to be configured with authentication port number, accounting port number, shared key for management vrf. The radius server should be started with same port number.
(config)#radius-server login host 10.12.17.11 seq-num 2 key 7 wawyanb123 auth-port 60000 acct-port 60000 timeout 6
Specify the radius server ipv4 address to be configured with port number for default vrf.The radius server should be started with same port number
(config)#aaa accounting default vrf management group radius
Enable accounting for radius server configured for vrf management
(config)#aaa accounting default group radius
Enable accounting for radius server configured for default vrf
(config)#commit
Commit the candidate configuration to the running configuration
Validation
#show aaa accounting vrf management
VRF: management
default: group radius
 
#show aaa accounting vrf all
VRF: management
default: group radius
 
VRF: default
default: group radius
 
#show aaa accounting
VRF: default
default: group radius
#
#show running-config aaa
aaa authentication login default vrf management group radius
aaa accounting default vrf management group radius
aaa group server radius rad1 vrf management
server Radius-Server-1 vrf management
server 100.0.0.1 vrf management
 
aaa authentication login default group radius
aaa accounting default group radius
aaa group server radius rad1
server Radius-Server-1
server 100.0.0.1
Sample Radius Clients.conf File
client 10.12.58.20 {
secret = testing123
shortname = localhost
}
client 192.168.1.2 {
secret = testing123
shortname = localhost
}
client 10.12.37.196 {
secret = testing123
}
client 100.0.0.2 {
secret = testing123
shortname = localhost
}
 
# IPv6 Client
#client ::1 {
# secret = testing123
# shortname = localhost
#}
#
# All IPv6 Site-local clients
#client fe80::/16 {
# secret = testing123
# shortname = localhost
Sample Radius Users Configuration File
#
#DEFAULT
# Service-Type = Login-User,
# Login-Service = Rlogin,
# Login-IP-Host = shellbox.ispdomain.com
 
# #
# # Last default: shell on the local terminal server.
# #
# DEFAULT
# Service-Type = Administrative-User
 
# On no match, the user is denied access.
 
selftest Cleartext-Password := "password"
testuser1 Cleartext-Password := "user1@101"
testuser2 Cleartext-Password := "user2@202"
testuser3 Cleartext-Password := "user3@303"
 
Fall Back Option for RADIUS Authentication
Currently, the Remote Authentication Dial-In User Service (RADIUS) server authentication fallback to the local authentication server only when the RADIUS server is not reachable.
This behavior is modified to forward the authentication request to the local authentication server when the RADIUS authentication is failed or not reachable.
Feature Characteristics
The RADIUS authentication mechanism is enhanced to fallback to local authentication server when the user
is not present on RADIUS server or
authentication fails from RADIUS server
To implement the above requirements, the existing CLI aaa authentication login default fallback error local non-existent-user vrf management is used to enable fallback to local authentication server. This is disabled by default.
Note: For invalid secret key there is no fallback local authentication.
Console authentication is not supported for RADIUS.
Benefits
By default, the fallback to local authentication is applied when the RADIUS server is unreachable. For other scenarios, enable the fallback using the CLI.
Configuration
Below is the existing CLI used to enable the fallback local authentication server.
aaa authentication login default fallback error local non-existent-user vrf management
Refer to Chapter 1, Authentication, Authorization and Accounting section in the OcNOS System Management Configuration Guide.
Validation
Configure aaa authentication console and verify console authentication:
OcNOS#con t
Enter configuration commands, one per line. End with CNTL/Z.
OcNOS(config)#radius-server login host 1.1.1.2 seq-num 1 key 0 kumar
OcNOS(config)#commit
OcNOS(config)#aaa authentication login console group radius
OcNOS(config)#commit
OcNOS(config)#exit
OcNOS#exit
 
OcNOS#show users
Current user : (*). Lock acquired by user : (#).
CLI user : [C]. Netconf users : [N].
Location : Applicable to CLI users.
Session : Applicable to NETCONF users.
 
Line User Idle Location/Session PID TYPE Role
(*) 0 con 0 [C]ocnos 0d00h00m ttyS0 5531 Remote network-admin
 
Enabled RADIUS local fallback and verify the authentication:
OcNOS(config)#aaa authentication login console group radius local
OcNOS(config)#commit
OcNOS(config)#exit
OcNOS#exit
OcNOS>exit
 
OcNOS>enable
OcNOS#show users
Current user : (*). Lock acquired by user : (#).
CLI user : [C]. Netconf users : [N].
Location : Applicable to CLI users.
Session : Applicable to NETCONF users.
 
Line User Idle Location/Session PID TYPE Role
(*) 0 con 0 [C]test 0d00h00m ttyS0 5713 Local network-engineer
130 vty 0 [C]test 0d00h01m pts/0 5688 Local network-engineer
OcNOS#