Cisco Catalyst 3750-E Series, Руководство по настройке программного обеспечения

Страница: 263 / 1414

9-35
Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-08
Chapter 9 Configuring Switch-Based Authentication
Controlling Switch Access with RADIUS
Note
Entering the no aaa accounting system guarantee-first command is not the only condition by which
the console or telnet session can be started. For example, if the privileged EXEC session is being
authenticated by TACACS and the TACACS server is not reachable, then the session cannot start.
Configuring Settings for All RADIUS Servers
Beginning in privileged EXEC mode, follow these steps to configure global communication settings
between the switch and all RADIUS servers:
To return to the default setting for the retransmit, timeout, and deadtime, use the no forms of these
commands.
Configuring the Switch to Use Vendor-Specific RADIUS Attributes
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating
vendor-specific information between the switch and the RADIUS server by using the vendor-specific
attribute (attribute 26). Vendor-specific attributes (VSAs) allow vendors to support their own extended
attributes not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific
option by using the format recommended in the specification. Cisco’s vendor-ID is 9, and the supported
option has vendor-type 1, which is named
cisco-avpair . The value is a string with this format:
protocol : attribute sep value *
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 radius-server key string Specify the shared secret text string used between the switch and all
RADIUS servers.
Note
The key is a text string that must match the encryption key used on
the RADIUS server. Leading spaces are ignored, but spaces within
and at the end of the key are used. If you use spaces in your key, do
not enclose the key in quotation marks unless the quotation marks
are part of the key.
Step 3
radius-server retransmit retries Specify the number of times the switch sends each RADIUS request to the
server before giving up. The default is 3; the range 1 to 1000.
Step 4 radius-server timeout seconds Specify the number of seconds a switch waits for a reply to a RADIUS
request before resending the request. The default is 5 seconds; the range is
1 to 1000.
Step 5 radius-server deadtime minutes Specify the number of minutes a RADIUS server, which is not responding
to authentication requests, to be skipped, thus avoiding the wait for the
request to timeout before trying the next configured server. The default is
0; the range is 1 to 1440 minutes.
Step 6
end Return to privileged EXEC mode.
Step 7
show running-config Verify your settings.
Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.