Cisco RadSec Configuring Guide: TLS/DTLS Server Setup & Restrictions (EN)

Restrictions for Configuring RadSec

Configuring RadSec This chapter describes how to configure RadSec over Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) servers. Restrictions for Configuring RadSec, on page 1 Information About RadSec, on page 2 How to Configure RadSec, on page 2 Monitoring RadSec, on page 7 Configuration Examples for RadSec, on page 7 Feature History for Configuring RadSec, on page 9 Restrictions for Configuring RadSec The following restrictions apply to the RadSec feature: • A RADIUS client uses an ephemeral port as the source port. This source port should not be used for UDP, Datagram Transport Layer Security (DTLS), and Transport Layer Security (TLS) at the same time.

• Although there is no configuration restriction, we recommend that you use the same type—either only TLS or only DTLS—for a server under an AAA server group. • RadSec is not supported on the DTLS port range 1 to 1024. DTLS ports must be configured to work with the RADIUS server. Note • RadSec is not supported with high availability. • RADIUS Change of Authorization (CoA) reception of request and transmission of response over the same authentication channel is supported with RadSec over TLS only. It is not supported over DTLS or plain RADIUS. • The tls watchdoginterval command is not applicable for Packet of Disconnect (PoD) use cases. • FQDN configuration for CoA is not supported.

• VRF-aware DNS resolution is not supported if configured with FQDNs. Configuring RadSec 1

Стр. 1

Configuring RadSec over TLS

Information About RadSec RadSec provides encryption services over the RADIUS server transported over a secure tunnel. RadSec over TLS and DTLS is implemented in both client and device servers. While the client side controls RADIUS AAA, the device side controls CoA. You can configure the following parameters: • Individual client-specific idle timeout, client trustpoint, and server trustpoint. • Global CoA-specific TLS or DTLS listening port and the corresponding list of source interfaces. You can disable TLS or DTLS for a specific server by using the no tls or no dtls command in radius server configuration mode.

Note RadSec CoA request reception and CoA response transmission over the same authentication channel can be enabled by configuring the tls watchdoginterval command. The TLS watchdog timer must be lesser than the TLS idle timer so that the established tunnel remains active if RADIUS test authentication packets are seen before the idle timer expires. If the tunnel is torn down and tls watchdoginterval command is enabled, the tunnel gets re-established immediately. If tls watchdoginterval command is disabled, CoA requests on the same authentication channel are discarded.

How to Configure RadSec The following sections provide information about the various tasks that comprise RadSec configuration. Configuring RadSec over TLS Procedure Configuring RadSec Information About RadSec Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode. Enter your password, if prompted. Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 radius server radius-server-name Example: Device(config)# radius server R1 Specifies the name for the RADIUS server configuration for Protected Access Credential (PAC) provisioning, and enters RADIUS server configuration mode. Configuring RadSec 2

Стр. 2

Configuring RadSec over TLS

Configuring RadSec Configuring RadSec over TLS Command or Action Purpose Step 4 tls [connectiontimeout connection-timeout-value] [idletimeout idle-timeout-value] [[ip | ipv6] {radius source-interface interface-name |vrf forwarding forwarding-table-name} ] [match-server-identity {email-address email-address | hostname host-name | ip-address ip-address}] [port port-number] [retries number-of-connection-retries] [trustpoint {client trustpoint name | server trustpoint name}] [watchdoginterval interval] Example:

Device(config-radius-server)# tls connectiontimeout 10 Device(config-radius-server)# tls idletimeout 75 Device(config-radius-server)# tls retries 15 Device(config-radius-server)# tls ip radius source-interface GigabitEthernet 1/0/1 Device(config-radius-server)# tls ipv6 vrf forwarding table-1 Device(config-radius-server)# tls match-server-identity ip-address 10.1.1.10 Device(config-radius-server)# tls port 10 Device(config-radius-server)# tls trustpoint client TP-self-signed-721943660 Device(config-radius-server)# tls trustpoint server isetp Device(config-radius-server)# tls watchdoginterval 10 Configures the TLS parameters. You can configure the following parameters: • connectiontimeout:

Configures TLS connection timeout value. The default is 5 seconds. • idletimeout: Configures the TLS idle timeout value. The default is 60 seconds. • ip: Configures IP source parameters. • ipv6: Configures IPv6 source parameters. • match-server-identity: Configures RadSec certification validation parameters. Note This is a mandatory configuration. • port: Configures the TLS port number. The default is 2083. • retries: Configures the number of TLS connection retries. The default is 5. • trustpoint: Configures the TLS trustpoint for a client and a server. If the TLS trustpoint for the client and server are the same, the trustpoint name should also be the same for both. • watchdoginterval:

Configures the watchdog interval. This enables CoA requests to be received on the same authentication channel. It also serves as a keepalive to keep the TLS tunnel up, and re-establishes the tunnel if it is torn down. Note watchdoginterval value must be lesser than idletimeout, for the established tunnel to remain up. Step 5 end Example: Device(config-radius-server)# end Exits RADIUS server configuration mode and returns to privileged EXEC mode. Configuring RadSec 3

Стр. 3

Configuring Dynamic Authorization for TLS CoA

Configuring Dynamic Authorization for TLS CoA Note When the tls watchdoginterval command is enabled, the client IP configuration under aaa server radius dynamic-author command is not used. Instead, the key configured under radius server command is used for CoA transactions. Procedure Configuring RadSec Configuring Dynamic Authorization for TLS CoA Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode. Enter your password, if prompted. Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 aaa server radius dynamic-author Example:

Device(config)# aaa server radius dynamic-author Enters dynamic authorization local server configuration mode and specifies the RADIUS client from which a device accepts CoA and disconnect requests. Configures the device as an AAA server to facilitate interaction with an external policy server. Step 4 client {ip-addr | hostname} [tls [client-tp client-tp-name] [ idletimeout idletimeout-interval ] [server-key server-key] [server-tp server-tp-name]] Example: Device(config-locsvr-da-radius)# client 10.104.49.14 tls idletimeout 100 client-tp tls ise server-tp tls client server-key _ _ key1 Configures the IP address or hostname of the AAA server client.

You can configure the following optional parameters: • tls: Enables TLS for the client. • client-tp: Configures the client trustpoint. • idletimeout: Configures the TLS idle timeout value. • server-key: Configures a RADIUS client server key. • server-tp: Configures the server trustpoint. Step 5 end Example: Device(config-locsvr-da-radius)# end Exits dynamic authorization local server configuration mode and returns to privileged EXEC mode. Configuring RadSec 4

Стр. 4