Transition Networks
S4224 Web User Guide
33558 Rev. C
Page 554 of 669
Configure FreeRadius or for Correct ADMIN Level
AAA ‘keyword attribute’
Problem
: When the privilege Levels with the Radius Account to the switch are not sent, you have read-
only access. FreeRadius is sending Privilege Level 5 per the default. (This also applies to with
service
=
shell
and
priv-lvl
=
x
.)
Meaning
: If the S4224 does not see these
attrs
then it defaults to level 1 (minimal access). The S4224
can do vendor specific values of Cisco and Zyxel:
Vendor-id: 9 (Cisco) Vendor-type: 1
Vendor-id: 890 (Zyxel) Vendor-type: 3
FreeRadius sends a Privilege Level 5 by default. The Keyword or attribute for Transition is vendor_value
syntax: "
shell:priv-lvl=x
" where x is an integer from 0 to 15. For Extreme it is ‘Extreme-CLI-Authorization’,
for ADVA DWDM ‘ADVA-ADMIN’, for other vendors, something else (e.g., the config for Extreme
Switches is
Extreme-CLI-Authorization
= 1).
Recovery
:
1. The current security privilege setting for the user must be 15. The S4224 range is 1 to 15 (where 15 is
the highest value / fullest possible access to all S4224 functions).
2. See “
AAA
Configuration
” on page
119
of the Web User Guide for more information on configuring via
the web interface. See the “
Security
AAA
commands” section
of the CLI Command Reference for more
information on configuring via the CLI. See the
Configuration
>
Security
>
Switch
>
Privilege
Levels
menu path. See the “
Security Switch Users
” commands section.
3. This works similarly for with
service
=
shell
and
priv-lvl
=
x
.
FreeRADIUS includes a RADIUS server, a BSD licensed client library, a PAM library, and an Apache
module. The word ‘FreeRADIUS’ usually refers to the RADIUS server. FreeRADIUS is the most widely
deployed RADIUS server in the world, and it is the basis for several commercial offerings. FreeRADIUS
supplies the AAA needs of many Fortune-500 companies and Tier 1 ISPs.
FreeRADIUS supports a simple processing language in its configuration files, called "un-language". The
goal of the language is to allow simple policies to be written with minimal effort. Those policies are then
applied when a request is being processed. Requests are processed through virtual servers (including the
default one), in the sections titled "authorize", "authenticate", "post-auth", "preacct", "accounting", "pre-
proxy", "post-proxy", and "session". The keywords for the language are a combination of pre-defined
keywords and references to loadable module names. Subject to a few limitations, any keyword can
appear in any context. The language consists of a series of entries, each one with one line. Each entry
begins with a keyword and entries are organized into lists. The language is processed line by line, from
the start of the list to the end. Actions are executed per-keyword.
For the FreeRADIUS “RADIUS Attribute List” see
http://freeradius.org/rfc/attributes.html
See
http://freeradius.org/radiusd/man/unlang.html
for the FreeRADIUS “unlang - FreeRADIUS Processing
un-language” page. The FreeRADIUS Version 2 Documentation page is at
(and RADIUS) have generally replaced the earlier protocols in more current networks.
uses TCP and RADIUS uses UDP; some administrators recommend because TCP
is considered more reliable. While RADIUS combines authentication and authorization in a user profile,
separates the two operations. is available from Cisco, shrubbery.net, rubyforge.org
and others.
