Device> enable Device# configure terminal Device(config)# aaa group server radius ppprad Device(config-sg-radius)# server 172.16.2.3 Device(config-sg-radius)# server 172.16.2 17 Device(config-sg-radius)# server 172.16.2.32 Device(config-sg-radius)# end This command specifies RADIUS servers 172.16.2.3, 172.16.2.17, and 172.16.2.32 as members of the group ppprad . To specify group ppprad as the method of user authentication at login when no other method list has been defined, enter the following command:
Device(config)# aaa authentication ppp default group ppprad Before you can use a group name as the PPP authentication method, you need to enable communication with the RADIUS or TACACS+ security server. For more information about establishing communication with a RADIUS server, refer to the chapter “Configuring RADIUS”. For more information about establishing communication with a TACACS+ server, refer to the chapter “Configuring TACACS+.” AAA Scalability for PPP Requests You can configure and monitor the number of background processes allocated by the PPP manager in the network access server (NAS) to deal with AAA authentication and authorization requests.
The AAA Scalability feature enables you to configure the number of processes used to handle AAA requests for PPP, thus increasing the number of users that can be simultaneously authenticated or authorized. To allocate a specific number of background processes to handle AAA requests for PPP, use the following command in global configuration mode: Device(config)# aaa processes 5000 The argument number defines the number of background processes earmarked to process AAA authentication and authorization requests for PPP and can be configured for any value from 1 to 2147483647.
Because of the way the PPP manager handles requests for PPP, this argument also defines the number of new users that can be simultaneously authenticated. This argument can be increased or decreased at any time. Allocating additional background processes can be expensive. You should configure the minimum number of background processes capable of handling the AAA requests for PPP. Note ARAP Authentication Using AAA ARAP Authentication Allowing Authorized Guest Logins Use the aaa authentication arap default command with the auth-guest keyword to allow guest logins only if the user has already successfully logged in to the EXEC.
This method must be the first listed in the ARAP authentication method list but it can be followed by other methods if it does not succeed. For example, to allow all authorized guest logins--meaning logins by users who have already successfully logged in to the EXEC--as the default method of authentication, using RADIUS only if that method fails, enter the following command: Device(config)# aaa authentication arap default auth-guest group radius Configuring Authentication AAA Scalability for PPP Requests Configuring Authentication 6