Cisco Catalyst 2960 Series, Configuration Manual

Page: 984 / 2288

• RADIUS is facilitated through AAA and can be enabled only through AAA commands.
• Use the
aaa new-model
global configuration command to enable AAA.
• Use the
aaa authentication
global configuration command to define method lists for RADIUS
authentication.
• Use line and interface commands to enable the defined method lists to be used.
• At a minimum, you must identify the host or hosts that run the RADIUS server software and define the
method lists for RADIUS authentication. You can optionally define method lists for RADIUS
authorization and accounting.
• You should have access to and should configure a RADIUS server before configuring RADIUS features
on your Switch.
• The RADIUS host is normally a multiuser system running RADIUS server software from Cisco (Cisco
Secure Access Control Server Version 3.0), Livingston, Merit, Microsoft, or another software provider.
For more information, see the RADIUS server documentation.
• To use the Change-of-Authorization (CoA) interface, a session must already exist on the switch. CoA
can be used to identify a session and enforce a disconnect request. The update affects only the specified
session.
For RADIUS operation:
• Users must first successfully complete RADIUS authentication before proceeding to RADIUS
authorization, if it is enabled.
Restrictions for Configuring RADIUS
This topic covers restrictions for controlling Switch access with RADIUS.
General:
• To prevent a lapse in security, you cannot configure RADIUS through a network management application.
RADIUS is not suitable in the following network security situations:
• Multiprotocol access environments. RADIUS does not support AppleTalk Remote Access (ARA),
NetBIOS Frame Control Protocol (NBFCP), NetWare Asynchronous Services Interface (NASI), or X.25
PAD connections.
• Switch-to-switch or router-to-router situations. RADIUS does not provide two-way authentication.
RADIUS can be used to authenticate from one device to a non-Cisco device if the non-Cisco device
requires authentication.
• Networks using a variety of services. RADIUS generally binds a user to one service model.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
902
Restrictions for Configuring RADIUS