Cisco IE 4000, Software Configuration Manual

Page: 159 / 1066

155
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
Note: A Disconnect-Request failure following command resend could be the result of either a successful session
termination before change-over (if the Disconnect-ACK was not sent) or a session termination by other means (for
example, a link failure) that occurred after the original command was issued and before the standby switch became
active.
CoA Request: Bounce-Port
This command is carried in a standard CoA-Request message that contains this VSA:
Cisco:Avpair="subscriber:command=bounce-host-port"
Because this command is session-oriented, it must be accompanied by one or more of the session identification
attributes described in the
CoA Session Identification, page 152 . If the session cannot be located, the switch returns a
CoA-NAK message with the “Session Context Not Found” error-code attribute. If the session is located, the switch
disables the hosting port for a period of 10 seconds, reenables it (port-bounce), and returns a CoA-ACK.
If the switch fails before returning a CoA-ACK to the client, the process is repeated on the new active switch when the
request is resent from the client. If the switch fails after returning a CoA-ACK message to the client but before the
operation has completed, the operation is restarted on the new active switch.
RADIUS Server Host
Switch-to-RADIUS-server communication involves several components:

Hostname or IP address

Authentication destination port

Accounting destination port

Key string

Timeout period

Retransmission value
You identify RADIUS security servers by their hostname or IP address, hostname and specific UDP port numbers, or their
IP address and specific UDP port numbers. The combination of the IP address and the UDP port number creates a unique
identifier, allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service. This
unique identifier enables RADIUS requests to be sent to multiple UDP ports on a server at the same IP address.
If two different host entries on the same RADIUS server are configured for the same service—for example,
accounting—the second host entry configured acts as a fail-over backup to the first one. Using this example, if the first
host entry fails to provide accounting services, the
%RADIUS-4-RADIUS_DEAD
message appears, and then the switch tries
the second host entry configured on the same device for accounting services. (The RADIUS host entries are tried in the
order that they are configured.)
A RADIUS server and the switch use a shared secret text string to encrypt passwords and exchange responses. To
configure RADIUS to use the AAA security commands, you must specify the host running the RADIUS server daemon
and a secret text (key) string that it shares with the switch.
The timeout, retransmission, and encryption key values can be configured globally for all RADIUS servers, on a per-server
basis, or in some combination of global and per-server settings. To apply these settings globally to all RADIUS servers
communicating with the switch, use the three unique global configuration commands:
radius-server timeout ,
radius-server retransmit , and radius-server key . To apply these values on a specific RADIUS server, use the
radius-server host global configuration command.
Note: If you configure both global and per-server functions (timeout, retransmission, and key commands) on the switch,
the per-server timer, retransmission, and key value commands override global timer, retransmission, and key value
commands. For information on configuring these settings on all RADIUS servers, see
Configuring Settings for All RADIUS