The RADIUS host is normally a multiuser system running RADIUS server software from Cisco (CiscoSecure ACS), Livingston, Merit,
Microsoft, or another software provider. Configuring device to RADIUS server communication can have several components:
RADIUS security servers are identified on the basis of their hostname or IP address, hostname and specific UDP port numbers,
or IP address and specific UDP port numbers. The combination of the IP address and UDP port number creates a unique identifier,
allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service. This unique identifier
enables RADIUS requests to be sent to multiple UDP ports on a server at the same IP address. If two different host entries
on the same RADIUS server are configured for the same service—for example, accounting—the second host entry configured acts
as a failover backup to the first one. If the first host entry fails to provide accounting services, the network access server
tries the second host entry configured on the same device for accounting services. (The RADIUS host entries are tried in the
order they are configured.)
A RADIUS server and a Cisco device use a shared secret text string to encrypt passwords and exchange responses. To configure
RADIUS to use the AAA security commands, you must specify the host running the RADIUS server daemon and a secret text (key)
string that it shares with the device.
The timeout, retransmission, and encryption key values are configurable globally for all RADIUS servers, on a per-server
basis or in some combination of global and per-server settings. To apply these settings globally to all RADIUS servers communicating
with the device, use the three unique global commands:
radius-server timeout ,
radius-server retransmit , and
radius-server key . To apply these values on a specific RADIUS server, use the
radius-server host command.
Note |
You can configure both global and per-server timeout, retransmission, and key value commands simultaneously on the same Cisco
network access server. If both global and per-server functions are configured on a device, the per-server timer, retransmission,
and key value commands override global timer, retransmission, and key value commands.
|