The RADIUS interface is enabled by default on Cisco devices. However, some basic configuration is required for the following attributes: • Security and Password—refer to the “Preventing Unauthorized Access to Your Switch” section in this guide. • Accounting—refer to the “Starting RADIUS Accounting” section in the Configuring Switch-Based Authentication chapter in this guide. Cisco IOS XE software supports the RADIUS CoA extensions defined in RFC 5176 that are typically used in a push model to allow the dynamic reconfiguring of sessions from external AAA or policy servers.
Per-session CoA requests are supported for session identification, session termination, host reauthentication, port shutdown, and port bounce. This model comprises one request (CoA-Request) and two possible response codes: • CoA acknowledgement (ACK) [CoA-ACK] • CoA nonacknowledgement (NAK) [CoA-NAK] The request is initiated from a CoA client (typically a AAA or policy server) and directed to the device that acts as a listener. The table below shows the RADIUS CoA commands and vendor-specific attributes (VSAs) supported by Identity-Based Networking Services. All CoA commands must include the session identifier between the device and the CoA client. Table 1:
RADIUS CoA Commands Supported by Identity-Based Networking Services Configuring RADIUS RADIUS Change of Authorization CoA Command Cisco VSA Activate service Cisco:Avpair=“subscriber:command=activate-service” Cisco:Avpair=“subscriber:service-name= ” Cisco:Avpair=“subscriber:precedence= ” Cisco:Avpair=“subscriber:activation-mode=replace-all” Deactivate service Cisco:Avpair=“subscriber:command=deactivate-service” Cisco:Avpair=“subscriber:service-name= ” Bounce host port Cisco:Avpair=“subscriber:command=bounce-host-port” Disable host port Cisco:Avpair=“subscriber:command=disable-host-port” Session query Cisco:Avpair=“subscriber:command=session-query” Session reauthenticate Cisco:Avpair=“subscriber:command=reauthenticate” Cisco:Avpair=“subscriber:reauthenticate-type=last” or Cisco:Avpair=“subscriber:reauthenticate-type=rerun” Session terminate This is a standard disconnect request and does not require a VSA.
Interface template Cisco:AVpair="interface-template-name= " Configuring RADIUS 5