RADIUS operation: • Users must first successfully complete RADIUS authentication before proceeding to RADIUS authorization, if it is enabled. • For RADIUS over IPv6 configurations, users must enable IPv6 unicast routing by enabling the ipv6 unicast-routing command. Restrictions for Configuring RADIUS General: • To prevent a lapse in security, you cannot configure RADIUS through a network management application. • VRF-aware DNS resolution is not supported if configured with FQDNs. RADIUS is not suitable in the following network security situations: • Multiprotocol access environments.
RADIUS does not support AppleTalk Remote Access (ARA), NetBIOS Frame Control Protocol (NBFCP), NetWare Asynchronous Services Interface (NASI), or X.25 PAD connections. • Switch-to-switch or router-to-router situations. RADIUS does not provide two-way authentication. RADIUS can be used to authenticate from one device to a non-Cisco device if the non-Cisco device requires authentication. • Networks using a variety of services. RADIUS generally binds a user to one service model. DSCP marking support for RADIUS packets: • DSCP marking for authentication and accounting is not supported for private servers, fully qualified domain name (FQDN) servers and radsec servers.
• In the case of wired IEEE 802.1x authentication, when source port extension is not enabled, the default ports are in use. The DSCP marking is set to the default ports and all the requests will be marked with the same DSCP value. • DSCP marking is not supported in the case of wireless IEEE 802.1x authentication, where the source port extension is enabled by default. Information about RADIUS RADIUS and Switch Access This section describes how to enable and configure RADIUS. RADIUS provides detailed accounting information and flexible administrative control over the authentication and authorization processes. Configuring RADIUS Restrictions for Configuring RADIUS Configuring RADIUS 2