Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1382 / 2086

49-102
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Controlling Switch Access with RADIUS
Because this command is session-oriented, it must be accompanied by one or more of the session identification attributes
described in the
“Session Identification” section on page 49-99 . If the session cannot be located, the switch returns a CoA-NAK
message with the “Session Context Not Found” error-code attribute. If the session is located, the switch disables the hosting
port for a period of 10 seconds, re-enables it (port-bounce), and returns a CoA-ACK.
If the switch fails before returning a CoA-ACK to the client, the process is repeated on the new active switch when the request
is re-sent from the client. If the switch fails after returning a CoA-ACK message to the client but before the operation has
completed, the operation is re-started on the new active switch.
Configuring RADIUS
This section describes how to configure your switch to support RADIUS. At a minimum, you must identify the host or hosts
that run the RADIUS server software and define the method lists for RADIUS authentication. You can optionally define method
lists for RADIUS authorization and accounting.
A method list defines the sequence and methods to be used to authenticate, to authorize, or to keep accounts on a user. You can
use method lists to designate one or more security protocols to be used (such as or local username lookup), thus
ensuring a backup system if the initial method fails. The software uses the first method listed to authenticate, to authorize, or
to keep accounts on users. If that method does not respond, the software selects the next method in the list. This process
continues until there is successful communication with a listed method or the method list is exhausted.
You should have access to and should configure a RADIUS server before configuring RADIUS features on your switch.
• Default RADIUS Configuration, page 49-102
•
Identifying the RADIUS Server Host, page 49-103 (required)
• Configuring RADIUS Login Authentication, page 49-105 (required)
•
Defining AAA Server Groups, page 49-107 (optional)
• Configuring RADIUS Authorization for User Privileged Access and Network Services, page 49-109 (optional)
•
Starting RADIUS Accounting, page 49-110 (optional)
• Configuring Settings for All RADIUS Servers, page 49-110 (optional)
•
Configuring the Switch to Use Vendor-Specific RADIUS Attributes, page 49-111 (optional)
• Configuring the Switch for Vendor-Proprietary RADIUS Server Communication, page 49-112 (optional)
•
Configuring CoA on the Switch, page 49-113
• Monitoring and Troubleshooting CoA Functionality, page 49-114
•
Configuring RADIUS Server Load Balancing, page 49-115 (optional)
Default RADIUS Configuration
RADIUS and AAA are disabled by default.
To prevent a lapse in security, you cannot configure RADIUS through a network management application. When enabled,
RADIUS can authenticate users accessing the switch using the CLI.