![background image](http://html.mh-extra.com/html/foundry-networks/switch-and-router/switch-and-router_installation-and-configuration-manual_2324275105.webp)
Securing Access to Management Functions
December 2000
3 - 41
Configuring RADIUS Accounting for CLI Commands
You can configure RADIUS accounting for CLI commands by specifying a privilege level whose commands require
accounting. For example, to configure the Foundry device to perform RADIUS accounting for the commands
available at the Super User privilege level (that is; all commands on the device), enter the following command:
BigIron(config)# aaa accounting commands 0 default start-stop radius
An Accounting Start packet is sent to the RADIUS accounting server when a user enters a command, and an
Accounting Stop packet is sent when the service provided by the command is completed.
NOTE:
If authorization is enabled, and the command requires authorization, then authorization is performed
before accounting takes place. If authorization fails for the command, no accounting takes place.
Syntax:
aaa accounting commands <privilege-level> default start-stop radius | tacacs | none
The <privilege-level> parameter can be one of the following:
•
0
– Records commands available at the Super User level (all commands)
•
4
– Records commands available at the Port Configuration level (port-config and read-only commands)
•
5
– Records commands available at the Read Only level (read-only commands)
Configuring RADIUS Accounting for System Events
You can configure RADIUS accounting to record when system events occur on the Foundry device. System
events include rebooting and when changes to the active configuration are made.
The following command causes an Accounting Start packet to be sent to the RADIUS accounting server when a
system event occurs, and a Accounting Stop packet to be sent when the system event is completed:
BigIron(config)# aaa accounting system default start-stop radius
Syntax:
aaa accounting system default start-stop radius | | none
Configuring an Interface as the Source for All RADIUS Packets
You can designate the lowest-numbered IP address configured an Ethernet port, POS port, loopback interface, or
virtual interface as the source IP address for all RADIUS packets from the Layer 3 Switch. Identifying a single
source IP address for RADIUS packets provides the following benefits:
•
If your RADIUS server is configured to accept packets only from specific links or IP addresses, you can use
this feature to simplify configuration of the RADIUS server by configuring the Foundry device to always send
the RADIUS packets from the same link or source address.
•
If you specify a loopback interface as the single source for RADIUS packets, RADIUS servers can receive the
packets regardless of the states of individual links. Thus, if a link to the RADIUS server becomes unavailable
but the client or server can be reached through another link, the client or server still receives the packets, and
the packets still have the source IP address of the loopback interface.
The software contains separate CLI commands for specifying the source interface for Telnet, TACACS/,
and RADIUS packets. You can configure a source interface for one or more of these types of packets.
To specify an Ethernet or POS port or a loopback or virtual interface as the source for all RADIUS packets from
the device, use the following CLI method. The software uses the lowest-numbered IP address configured on the
port or interface as the source IP address for RADIUS packets originated by the device.
To specify the lowest-numbered IP address configured on a virtual interface as the device’s source for all RADIUS
packets, enter commands such as the following:
BigIron(config)# int ve 1
BigIron(config-vif-1)# ip address 10.0.0.3/24
BigIron(config-vif-1)# exit
BigIron(config)# ip radius source-interface ve 1
Summary of Contents for Switch and Router
Page 2: ...December 2000 Copyright 2000 by Foundry Networks Inc ...
Page 26: ...Foundry Switch and Router Installation and Configuration Guide xxvi December 2000 ...
Page 64: ...Foundry Switch and Router Installation and Configuration Guide 2 34 December 2000 ...
Page 162: ...Foundry Switch and Router Installation and Configuration Guide 5 38 December 2000 ...
Page 196: ...Foundry Switch and Router Installation and Configuration Guide 6 34 December 2000 ...
Page 208: ...Foundry Switch and Router Installation and Configuration Guide 7 12 December 2000 ...
Page 236: ...Foundry Switch and Router Installation and Configuration Guide 8 28 December 2000 ...
Page 258: ...Foundry Switch and Router Installation and Configuration Guide 9 22 December 2000 ...
Page 420: ...Foundry Switch and Router Installation and Configuration Guide 13 32 December 2000 ...
Page 442: ...Foundry Switch and Router Installation and Configuration Guide 14 22 December 2000 ...
Page 554: ...Foundry Switch and Router Installation and Configuration Guide 15 112 December 2000 ...
Page 574: ...Foundry Switch and Router Installation and Configuration Guide 16 20 December 2000 ...
Page 626: ...Foundry Switch and Router Installation and Configuration Guide 17 52 December 2000 ...
Page 682: ...Foundry Switch and Router Installation and Configuration Guide 18 56 December 2000 ...
Page 826: ...Foundry Switch and Router Installation and Configuration Guide 20 20 December 2000 ...
Page 994: ...Foundry Switch and Router Installation and Configuration Guide 26 10 December 2000 ...
Page 1004: ...Foundry Switch and Router Installation and Configuration Guide B 6 December 2000 ...
Page 1044: ...Foundry Switch and Router Installation and Configuration Guide C 40 December 2000 ...
Page 1048: ...Foundry Switch and Router Installation and Configuration Guide D 4 December 2000 ...
Page 1070: ...Foundry Switch and Router Installation and Configuration Guide Index 18 December 2000 ...