Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1389 / 2086

49-109
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Controlling Switch Access with RADIUS
To remove the specified RADIUS server, use the no radius-server host hostname | ip-address global configuration command.
To remove a server group from the configuration list, use the no aaa group server radius group-name global configuration
command. To remove the IP address of a RADIUS server, use the no server ip-address server group configuration command.
In this example, the switch is configured to recognize two different RADIUS group servers ( group1 and group2 ). Group1 has
two different host entries on the same RADIUS server configured for the same services. The second host entry acts as a failover
backup to the first entry.
Switch(config)# radius-server host 172.20.0.1 auth-port 1000 acct-port 1001
Switch(config)# radius-server host 172.10.0.1 auth-port 1645 acct-port 1646
Switch(config)# aaa new-model
Switch(config)# aaa group server radius group1
Switch(config-sg-radius)# server 172.20.0.1 auth-port 1000 acct-port 1001
Switch(config-sg-radius)# exit
Switch(config)# aaa group server radius group2
Switch(config-sg-radius)# server 172.20.0.1 auth-port 2000 acct-port 2001
Switch(config-sg-radius)# exit
Configuring RADIUS Authorization for User Privileged Access and Network Services
AAA authorization limits the services available to a user. When AAA authorization is enabled, the switch uses information
retrieved from the user’s profile, which is in the local user database or on the security server, to configure the user’s session.
The user is granted access to a requested service only if the information in the user profile allows it.
You can use the aaa authorization global configuration command with the radius keyword to set parameters that restrict a
user’s network access to privileged EXEC mode.
The aaa authorization exec radius local command sets these authorization parameters:
• Use RADIUS for privileged EXEC access authorization if authentication was performed by using RADIUS.
•
Use the local database if authentication was not performed by using RADIUS.
Note
Authorization is bypassed for authenticated users who log in using the CLI even if authorization has been
configured.
To specify RADIUS authorization for privileged EXEC access and network services, perform this task:
Step 8
Switch# copy running-config
startup-config
(Optional) Saves your entries in the configuration file.
Step 9
Enables RADIUS login authentication. See the “Configuring RADIUS
Login Authentication” section on page 49-105 .
Command Purpose
Step 1
Switch# configure terminal
Enters global configuration mode.
Step 2
Switch(config)# aaa authorization
network radius
Configures the switch for user RADIUS authorization for all
network-related service requests.
Step 3
Switch(config)# aaa authorization
exec radius
Configures the switch for user RADIUS authorization if the user has
privileged EXEC access.
The exec keyword might return user profile information (such as
autocommand information).
Command Purpose