• Networks that require resource accounting. You can use RADIUS accounting independent of RADIUS
authentication or authorization. The RADIUS accounting functions allow data to be sent at the start and
end of services, indicating the amount of resources (such as time, packets, bytes, and so on) used during
the session. An Internet service provider (ISP) might use a freeware-based version of the RADIUS access
control and accounting software to meet special security and billing needs.
• Networks that support authentication profiles. Using the RADIUS server in your network, you can
configure AAA authentication and set up per-user profiles. Per-user profiles enable the Cisco NX-OS
device to better manage ports using their existing RADIUS solutions and to efficiently manage shared
resources to offer different service-level agreements.
RADIUS Operation
When a user attempts to log in and authenticate to a Cisco NX-OS device using RADIUS, the following
process occurs:
• The user is prompted for and enters a username and password.
• The username and encrypted password are sent over the network to the RADIUS server.
• The user receives one of the following responses from the RADIUS server:
ACCEPT
The user is authenticated.
REJECT
The user is not authenticated and is prompted to reenter the username and password, or access is denied.
CHALLENGE
A challenge is issued by the RADIUS server. The challenge collects additional data from the user.
CHANGE PASSWORD
A request is issued by the RADIUS server, asking the user to select a new password.
The ACCEPT or REJECT response is bundled with additional data that is used for EXEC or network
authorization. You must first complete RADIUS authentication before using RADIUS authorization. The
additional data included with the ACCEPT or REJECT packets consists of the following:
• Services that the user can access, including Telnet, rlogin, or local-area transport (LAT) connections,
and Point-to-Point Protocol (PPP), Serial Line Internet Protocol (SLIP), or EXEC services.
• Connection parameters, including the host or client IPv4 or IPv6 address, access list, and user timeouts.
RADIUS Server Monitoring
An unresponsive RADIUS server can cause a delay in processing AAA requests. You can configure the Cisco
NX-OS device to periodically monitor a RADIUS server to check whether it is responding (or alive) to save
time in processing AAA requests. The Cisco NX-OS device marks unresponsive RADIUS servers as dead
and does not send AAA requests to any dead RADIUS servers. The Cisco NX-OS device periodically monitors
the dead RADIUS servers and brings them to the alive state once they respond. This monitoring process
verifies that a RADIUS server is in a working state before real AAA requests are sent its way. Whenever a
RADIUS server changes to the dead or alive state, a Simple Network Management Protocol (SNMP) trap is
generated and the Cisco NX-OS device displays an error message that a failure is taking place.
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
40
Configuring RADIUS
RADIUS Operation
