When you use RADIUS servers for authentication on a Cisco Nexus device, the RADIUS protocol directs
the RADIUS server to return user attributes, such as authorization information, with authentication results.
This authorization information is specified through VSAs.
The following VSA protocol options are supported by the Cisco Nexus device:
•
Shell
—
Used in access-accept packets to provide user profile information.
•
Accounting
—
Used in accounting-request packets. If a value contains any white spaces, you should
enclose the value within double quotation marks.
The Cisco Nexus device supports the following attributes:
•
roles
—
Lists all the roles to which the user belongs. The value field is a string that lists the role names
delimited by white spaces.
•
accountinginfo
—
Stores accounting information in addition to the attributes covered by a standard
RADIUS accounting protocol. This attribute is sent only in the VSA portion of the Account-Request
frames from the RADIUS client on the switch. It can be used only with the accounting protocol data
units (PDUs).
Prerequisites for RADIUS
RADIUS has the following prerequisites:
•
You must obtain IPv4 or IPv6 addresses or hostnames for the RADIUS servers.
•
You must obtain preshared keys from the RADIUS servers.
•
Ensure that the Cisco Nexus device is configured as a RADIUS client of the AAA servers.
Guidelines and Limitations for RADIUS
RADIUS has the following configuration guidelines and limitations:
•
You can configure a maximum of 64 RADIUS servers on the device.
Configuring RADIUS Servers
This section describes how to configure RADIUS servers.
Procedure
Step 1
Establish the RADIUS server connections to the Cisco Nexus device.
See
Configuring RADIUS Server Hosts, on page 33
.
Step 2
Configure the preshared secret keys for the RADIUS servers.
Cisco Nexus 3600 NX-OS Security Configuration Guide, Release 7.x
32
Configuring RADIUS
Prerequisites for RADIUS
