Configuring RADIUS Prerequisites for Configuring RADIUS, on page 1 Restrictions for Configuring RADIUS, on page 2 Information about RADIUS, on page 2 How to Configure RADIUS, on page 25 Monitoring CoA Functionality, on page 40 Feature History for RADIUS, on page 40 Prerequisites for Configuring RADIUS This section lists the prerequisites for controlling device access with RADIUS. General: • RADIUS and Authentication, Authorization, and Accounting (AAA) must be enabled to use any of the configuration commands in this chapter. • RADIUS is facilitated through AAA and can be enabled only through AAA commands. • Use the aaa new-model global configuration command to enable AAA.
• Use the aaa authentication global configuration command to define method lists for RADIUS authentication. • Use line and interface commands to enable the defined method lists to be used. • At a minimum, you must identify the host or hosts that run the RADIUS server software and define the method lists for RADIUS authentication. You can optionally define method lists for RADIUS authorization and accounting. • You should have access to and should configure a RADIUS server before configuring RADIUS features on your device.
• The RADIUS host is normally a multiuser system running RADIUS server software from Cisco (Cisco Secure Access Control Server Version 3.0), Livingston, Merit, Microsoft, or another software provider. For more information, see the RADIUS server documentation. • To use the Change-of-Authorization (CoA) interface, a session must already exist on the switch. CoA can be used to identify a session and enforce a disconnect request. The update affects only the specified session. Configuring RADIUS 1