Cisco RADIUS Configuration Guide: User & Service Manual PDF (EN)

Prerequisites for Configuring RADIUS

Configuring RADIUS Prerequisites for Configuring RADIUS, on page 1 Restrictions for Configuring RADIUS, on page 2 Information about RADIUS, on page 2 How to Configure RADIUS, on page 25 Monitoring CoA Functionality, on page 40 Feature History for RADIUS, on page 40 Prerequisites for Configuring RADIUS This section lists the prerequisites for controlling device access with RADIUS. General: • RADIUS and Authentication, Authorization, and Accounting (AAA) must be enabled to use any of the configuration commands in this chapter. • RADIUS is facilitated through AAA and can be enabled only through AAA commands. • Use the aaa new-model global configuration command to enable AAA.

• Use the aaa authentication global configuration command to define method lists for RADIUS authentication. • Use line and interface commands to enable the defined method lists to be used. • At a minimum, you must identify the host or hosts that run the RADIUS server software and define the method lists for RADIUS authentication. You can optionally define method lists for RADIUS authorization and accounting. • You should have access to and should configure a RADIUS server before configuring RADIUS features on your device.

• The RADIUS host is normally a multiuser system running RADIUS server software from Cisco (Cisco Secure Access Control Server Version 3.0), Livingston, Merit, Microsoft, or another software provider. For more information, see the RADIUS server documentation. • To use the Change-of-Authorization (CoA) interface, a session must already exist on the switch. CoA can be used to identify a session and enforce a disconnect request. The update affects only the specified session. Configuring RADIUS 1

Стр. 1

RADIUS and Switch Access

RADIUS operation: • Users must first successfully complete RADIUS authentication before proceeding to RADIUS authorization, if it is enabled. • For RADIUS over IPv6 configurations, users must enable IPv6 unicast routing by enabling the ipv6 unicast-routing command. Restrictions for Configuring RADIUS General: • To prevent a lapse in security, you cannot configure RADIUS through a network management application. • VRF-aware DNS resolution is not supported if configured with FQDNs. RADIUS is not suitable in the following network security situations: • Multiprotocol access environments.

RADIUS does not support AppleTalk Remote Access (ARA), NetBIOS Frame Control Protocol (NBFCP), NetWare Asynchronous Services Interface (NASI), or X.25 PAD connections. • Switch-to-switch or router-to-router situations. RADIUS does not provide two-way authentication. RADIUS can be used to authenticate from one device to a non-Cisco device if the non-Cisco device requires authentication. • Networks using a variety of services. RADIUS generally binds a user to one service model. DSCP marking support for RADIUS packets: • DSCP marking for authentication and accounting is not supported for private servers, fully qualified domain name (FQDN) servers and radsec servers.

• In the case of wired IEEE 802.1x authentication, when source port extension is not enabled, the default ports are in use. The DSCP marking is set to the default ports and all the requests will be marked with the same DSCP value. • DSCP marking is not supported in the case of wireless IEEE 802.1x authentication, where the source port extension is enabled by default. Information about RADIUS RADIUS and Switch Access This section describes how to enable and configure RADIUS. RADIUS provides detailed accounting information and flexible administrative control over the authentication and authorization processes. Configuring RADIUS Restrictions for Configuring RADIUS Configuring RADIUS 2

Стр. 2

RADIUS Operation

RADIUS Overview RADIUS is a distributed client/server system that secures networks against unauthorized access. RADIUS clients run on supported Cisco devices. Clients send authentication requests to a central RADIUS server, which contains all user authentication and network service access information. Use RADIUS in these network environments that require access security: • Networks with multiple-vendor access servers, each supporting RADIUS. For example, access servers from several vendors use a single RADIUS server-based security database.

In an IP-based network with multiple vendors’ access servers, dial-in users are authenticated through a RADIUS server that has been customized to work with the Kerberos security system. • Turnkey network security environments in which applications support the RADIUS protocol, such as in an access environment that uses a smart card access control system. • Networks already using RADIUS. You can add a Cisco device containing a RADIUS client to the network. This might be the first step when you make a transition to a TACACS+ server. See the illustration: Transitioning from RADIUS to TACACS+ Services below. Figure 1:

Transitioning from RADIUS to TACACS+ Services • Network in which the user must only access a single service. Using RADIUS, you can control user access to a single host, to a single utility such as Telnet, or to the network through a protocol such as IEEE 802.1x. For more information about this protocol, see the chapter Configuring IEEE 802.1x Port-Based Authentication . • Networks that require resource accounting. You can use RADIUS accounting independently of RADIUS authentication or authorization. The RADIUS accounting functions allow data to be sent at the start and end of services, showing the amount of resources (such as time, packets, bytes, and so forth) used during the session.

An Internet service provider might use a freeware-based version of RADIUS access control and accounting software to meet special security and billing needs. RADIUS Operation When a user attempts to log in and authenticate to a device that is access controlled by a RADIUS server, these events occur: 1. The user is prompted to enter a username and password. Configuring RADIUS RADIUS Overview Configuring RADIUS 3

Стр. 3

RADIUS Change of Authorization

2. The username and encrypted password are sent over the network to the RADIUS server. 3. The user receives one of the following responses from the RADIUS server: • ACCEPT: The user is authenticated. • REJECT: The user is either not authenticated and is prompted to re-enter the username and password, or access is denied. • CHALLENGE: A challenge requires additional data from the user. • CHALLENGE PASSWORD: A response requests the user to select a new password. The ACCEPT or REJECT response is bundled with additional data that is used for privileged EXEC or network authorization. The additional data included with the ACCEPT or REJECT packets includes these items:

• Telnet, SSH, rlogin, or privileged EXEC services • Connection parameters, including the host or client IP address, access list, and user timeouts RADIUS Change of Authorization The RADIUS Change of Authorization (CoA) provides a mechanism to change the attributes of an authentication, authorization, and accounting (AAA) session after it is authenticated. When a policy changes for a user or user group in AAA, administrators can send RADIUS CoA packets from the AAA server such as a Cisco Secure Access Control Server (ACS) to reinitialize authentication and apply the new policy.

This section provides an overview of the RADIUS interface including available primitives and how they are used during a CoA. • Change-of-Authorization Requests • CoA Request Response Code • CoA Request Commands • Session Reauthentication • Stacking Guidelines for Session Termination A standard RADIUS interface is typically used in a pulled model where the request originates from a network attached device and the response come from the queried servers. Cisco devices support the RADIUS CoA extensions defined in RFC 5176 that are typically used in a pushed model and allow for the dynamic reconfiguring of sessions from external AAA or policy servers.

Cisco devices supports these per-session CoA requests: • Session reauthentication • Session termination • Session termination with port shutdown • Session termination with port bounce This feature is integrated with Cisco Secure Access Control Server (ACS) 5.1. Configuring RADIUS RADIUS Change of Authorization Configuring RADIUS 4

Стр. 4