Remote Authentication Dial In User Service (RADIUS) is a remote authentication protocol that is used to communicate with an authentication server. A RADIUS server is responsible for receiving user connection requests, authenticating the user, and then returning all configuration information necessary for the client to deliver service to the user.

The OcNOS device, acting as a RADIUS client, sends the user’s credentials to the RADIUS server requesting authentication. The RADIUS server validates the received user’s credentials and authenticates it. After the authentication, it authorizes the user’s privilege level and shares it with the OcNOS. Thus, the user role is decided based on the received privilege level.

The key points for RADIUS authentication are:

In OcNOS version 6.4.1, the RADIUS is not present on radius server or authentication fails from RADIUS server

To implement the above requirements, the existing CLI aaa authentication login default fallback error is used to enable fallback to local authentication server. This is disabled by default.

By default, the fallback to local authentication is applied when the Radius server is unreachable. For other scenarios, enable the fallback using the CLI.

In OcNOS version 6.4.2, the RADIUS Authorization is supported.

Based on the privilege level received from the RADIUS server user role is determined.

RADIUS server process must be up and running.

Following is the RADIUS client and server network topology.

RADIUS server address is configured in IPv4 address format.

 

Specifies privilege level in radius server configuration file. The RADIUS client fetch the network operator privilege level from this file. The Privilege level range is between 0-15.

To verify the RADIUS authorization process, login from the host machine to Host IP with the authenticating user credentials and provide a RADIUS server password.

Execute following show commands to verify the Radius authorization status.

 

RADIUS server address is configured in IPv6 address.

 

To verify the RADIUS authorization process, login from the host machine to Host IP with the authenticating user credentials and provide a RADIUS server password.

Execute following show commands to verify the Radius authorization status.

Following is an example for radius-server configuration file:

 

 

 

Radius server address is configured as IPv4 address.

To verify the RADIUS authentication process, use SSH or Telnet from the host machine to Host IP with the authenticating user created, and provide a RADIUS server password and check whether the client validates the user with the corresponding username and password.

Radius server address is configured as IPv6 address. Authentication messages are transmitted to radius server from the Router using IPv6 address.

Figure 3-3 shows the sample configuration of Radius server.

Perform TELNET to the Router R1. Provide the username mentioned in the radius server "users" file as telnet username. Check that R1 sends radius request to the radius server using IPv6 address.

You can configure accounting to measure the resources that another user consumes during access.

The RADIUS authentication mechanism is enhanced to fallback to local authentication server when the user

To implement the above requirements, the existing CLI aaa authentication login default fallback error local non-existent-user vrf management is used to enable fallback to local authentication server. This is disabled by default.

By default, the fallback to local authentication is applied when the RADIUS server is unreachable. For other scenarios, enable the fallback using the CLI.

Below is the existing CLI used to enable the fallback local authentication server.

Refer to Chapter 1, Authentication, Authorization and Accounting section in the OcNOS System Management Configuration Guide.

Configure aaa authentication console and verify console authentication:

Enabled RADIUS local fallback and verify the authentication: