19-18
Ethernet Card Software Feature and Configuration Guide, R7.2
January 2009
Chapter 19 Configuring Security for the ML-Series Card
Configuring RADIUS
To return to the default setting for the retransmit, timeout, and deadtime, use the no forms of these
commands.
Configuring the ML-Series Card to Use Vendor-Specific RADIUS Attributes
The Internet Engineering Task Force (IETF) draft standard specifies a method fo r communicating
vendor-specific information between the ML-Series card and the RADIUS server by using the
vendor-specific attribute (attribute 26). Vendor-specific attributes (VSAs) allow vendors to support their
own extended attributes that are not suitable for general use. The Cisco RADIUS implementation
supports one vendor-specific option by using the format recommended in the specification. Cisco’s
vendor-ID is 9, and the supported option has vendor-type 1, which is named cisco-avpair. The value is
a string with this format:
protocol : attribute sep value *
Protocol is a value of the Cisco protocol attribute for a particular type of authorization. Attribute and
value are an appropriate attribute-value (AV) pair defined in the Cisco Terminal Access Controller
Access Control System Plus (TACACS+) specification, and sep is the character = for mandatory
attributes and the character * for optional attributes. The full set of features available for TACACS+
authorization can then be used for RADIUS.
For example, this AV pair activates Cisco’s multiple named ip address pools feature during IP
authorization (during point-to-point protocol [PPP] internet protocol control protocol (IPCP) address
assignment):
cisco-avpair= ”ip:addr-pool=first“
This example shows how to specify an authorized VLAN in the RADIUS server database:
cisco-avpair= ”tunnel-type(#64)=VLAN(13)”
cisco-avpair= ”tunnel-medium-type(#65)=802 media(6)”
cisco-avpair= ”tunnel-private-group-ID(#81)=vlanid”
This example shows how to apply an input access control list (ACL) in ASCII format to an interface for
the duration of this connection:
cisco-avpair= “ip:inacl#1=deny ip 10.10.10.10 0.0.255.255 20.20.20.20 255.255.0.0”
cisco-avpair= “ip:inacl#2=deny ip 10.10.10.10 0.0.255.255 any”
cisco-avpair= “mac:inacl#3=deny any any decnet-iv”
This example shows how to apply an output ACL in ASCII format to an interface for the duration of this
connection:
Step 5 Router (config)# radius-server
deadtime minutes
Specify the number of minutes to mark as "dead" a ny RADIUS servers that
fail to respond to authentication requests. A RADIUS server marked as
"dead" is skipped by additional authentication requests for the specified
number of minutes. This allows trying the next configured server without
having to wait for the request to time out before. If all RADIUS servers are
marked as "dead," the skipping will not take place.
The default is 0; the range is 1 to 1440 minutes.
Step 6 Router (config)# end Return to privileged EXEC mode.
Step 7 Router# show running-config Verify your settings.
Step 8 Router# copy running-config
startup-config
(Optional) Save your entries in the configuration file.
Command Purpose