Cisco IE 4000, Software Configuration Manual

Page: 178 / 1066

174
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Defining AAA Server Groups
Command Purpose
1. configure terminal Enters global configuration mode.
2. radius-server host { hostname |
ip-address } [ auth-port
port-number ] [ acct-port
port-number ] [ timeout seconds ]
[ retransmit retries ] [ key string ]
Specifies the IP address or hostname of the remote RADIUS server host.

(Optional) auth-port port-number —Specifies the UDP destination port for
authentication requests.

(Optional) acct-port port-number —Specifies the UDP destination port for
accounting requests.

(Optional) timeout seconds —Specifies the time interval that the switch
waits for the RADIUS server to reply before resending. The range is 1 to
1000. This setting overrides the
radius-server timeout global
configuration command setting. If no timeout is set with the
radius-server host command, the setting of the radius-server timeout
command is used.

(Optional) retransmit retries —Specifies the number of times a RADIUS
request is resent to a server if that server is not responding or responding
slowly. The range is 1 to 1000. If no retransmit value is set with the
radius-server host command, the setting of the radius-server
retransmit global configuration command is used.

(Optional) key string , specifies the authentication and encryption key
used between the switch and the RADIUS daemon running on the
RADIUS server.
Note: The key is a text string that must match the encryption key used on the
RADIUS server. Always configure the key as the last item in the radius-server
host command. Leading spaces are ignored, but spaces within and at the end
of the key are used. If you use spaces in your key, do not enclose the key in
quotation marks unless the quotation marks are part of the key.
To configure the switch to recognize more than one host entry associated with
a single IP address, enter this command as many times as necessary, making
sure that each UDP port number is different. The switch software searches for
hosts in the order in which you specify them. Set the timeout, retransmit, and
encryption key values to use with the specific RADIUS host.
3. aaa new-model Enables AAA.
4. aaa group server radius
group-name
Defines the AAA server group with a group name.
This command puts the switch in a server group configuration mode.
5. server ip-address Associates a particular RADIUS server with the defined server group. Repeat
this step for each RADIUS server in the AAA server group.
Each server in the group must be previously defined in Step 2.
6. end Returns to privileged EXEC mode.
7. Enable RADIUS login authentication. See Defining AAA Server Groups,
page 174 .