Login Authentication Using Group RADIUS Use the aaa authentication login default command with the group radius to specify RADIUS as the login authentication method. For example, to specify RADIUS as the method of user authentication at login when no other method list has been defined, enter the following command: Device(config)# aaa authentication login default group radius Before you can use RADIUS as the login authentication method, you need to enable communication with the RADIUS security server.
For more information about establishing communication with a RADIUS server, refer to the chapter “Configuring RADIUS.” RADIUS Attribute 8 in Access Requests After you have used the aaa authentication login command to specify RADIUS and your login host has been configured to request its IP address from the NAS, you can send attribute 8 (Framed-IP-Address) in access-request packets by using the radius-server attribute 8 include-in-access-req command in global configuration mode. This command makes it possible for NAS to provide the RADIUS server a hint of the user IP address in advance for user authentication.
Login Authentication Using Group TACACS Use the aaa authentication login default command with the group tacacs+ to specify TACACS+ as the login authentication method. For example, to specify TACACS+ as the method of user authentication at login when no other method list has been defined, enter the following command: Device(config)# aaa authentication login default group tacacs+ Before you can use TACACS+ as the login authentication method, you need to enable communication with the TACACS+ security server.
For more information about establishing communication with a TACACS+ server, refer to the chapter “Configuring TACACS+.” If the ip radius source interface command is configured under the group, the MTU of the source interface is used for injecting the packet. And if not configured, default fragmentation at 1396 bytes is done. Note Login Authentication Using Group Name Use the aaa authentication login default command with the group group-name method to specify a subset of RADIUS or TACACS+ servers to use as the login authentication method. To specify and define the group name and the members of the group, use the aaa group server command.
For example, use the aaa group server command to first define the members of group loginrad : Device> enable Device# configure terminal Device(config)# aaa group server radius loginrad Device(config-sg-radius)# server 172.16.2.3 Device(config-sg-radius)# server 172.16.2 17 Device(config-sg-radius)# server 172.16.2.32 Device(config-sg-radius)# end This command specifies RADIUS servers 172.16.2.3, 172.16.2.17, and 172.16.2.32 as members of the group loginrad . To specify group loginrad as the method of user authentication at login when no other method list has been defined, enter the following command:
Configuring Authentication Login Authentication Using Group RADIUS Configuring Authentication 4