Cisco Systems 0L-11350-01

13-10

Cisco IOS Software Configuration Guide for Cisco Aironet Access Points

OL-11350-01

Chapter13 Configuring RADIUS and TACACS+ Servers

Configuring and Enabling RADIUS

Step3 radius-server host {hostname |

ip-address} [auth-port port-number]

[acct-port port-number] [timeout

seconds] [retransmit retries] [key

string]

Specify the IP address or host name of the remote RADIUS server host.

•(Optional) For auth-port port-number, specify the UDP destination

port for authentication requests.

•(Optional) For acct-port port-number, specify the UDP destination

port for accounting requests.

•(Optional) For timeout seconds, specify the time interval that the

access point waits for the RADIUS server to reply before

retransmitting. The range is 1 to 1000. This setting overrides the

radius-server timeout global configuration command setting. If no

timeout is set with the radius-server host command, the setting of

the radius-server timeout command is used.

•(Optional) For retransmit retries, specify the number of times a

RADIUS request is resent to a server if that server is not responding

or responding slowly. The range is 1 to 1000. If no retransmit value

is set with the radius-server host command, the setting of the

radius-server retransmit global configuration command is used.

•(Optional) For key string, specify the authentication and encryption

key used between the access point and the RADIUS daemon running

on the RADIUS server.

Note The key is a text string that must match the encryption key used

on the RADIUS server. Always configure the key as the last item

in the radius-server host command. Leading spaces are ignored,

but spaces within and at the end of the key are used. If you use

spaces in your key, do not enclose the key in quotation marks

unless the quotation marks are part of the key.

To configure the access point to recognize more than one host entry

associated with a single IP address, enter this command as many times as

necessary, making sure that each UDP port number is different. The

access point software searches for hosts in the order in which you specify

them. Set the timeout, retransmit, and encryption key values to use with

the specific RADIUS host.

Step4 aaa group server radius group-name Define the AAA server-group with a group name.

This command puts the access point in a server group configuration mode.

Step5 server ip-address Associate a particular RADIUS server with the defined server group.

Repeat this step for each RADIUS server in the AAA server group.

Each server in the group must be previously defined in Step 2.

Step6 end Return to privileged EXEC mode.

Step7 show running-config Verify your entries.

Step8 copy running-config startup-config (Optional) Save your entries in the configuration file.

Step9 Enable RADIUS login authentication. See the “Configuring RADIUS

Command Purpose