8-20
Catalyst 2960 Switch SoftwareConfiguration Guide
78-16881-01
Chapter8 Configuring Switch-Based Authentication
Controlling Switch Access with RADIUS
Configuring RADIUS
This section describes how to configure your switch to support RADIUS. At a minimum, you must
identify the host or hosts that run the RADIUS server software and define the method lists f or RADIUS
authentication. You can optionally define method lists for RADIUS authorization and accounting.
A method list defines the sequence and methods to be used to authenticate, to authoriz e, or to keep
accounts on a user. You can use method lists to designate one or more security protocol s to be used (such
as TACACS+ or local username lookup), thus ensuring a backup system if the initial method fails. The
software uses the first method listed to authenticate, to authorize, or to keep accounts on users; if that
method does not respond, the software selects the next method in the list. This process continues until
there is successful communication with a listed method or the method list is exhausted.
You should have access to and should configure a RADIUS server before configuring RADIUS features
on your switch.
These sections contain this configuration information:
Default RADIUS Configuration, page 8-20
Identifying the RADIUS Server Host, page 8-20 (required)
Configuring RADIUS Login Authentication, page 8-23 (required)
Defining AAA Server Groups, page 8-25 (optional)
Configuring RADIUS Authorization for User Privileged Access and Network Services, page 8-27
(optional)
Starting RADIUS Accounting, page 8-28 (optional)
Configuring Settings for All RADIUS Servers, page 8-29 (optional)
Configuring the Switch to Use Vendor-Specific RADIUS Attributes, page 8-29 (optional)
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication, page 8-30
(optional)

Default RADIUS Configuration

RADIUS and AAA are disabled by default.
To prevent a lapse in security, you cannot configure RADIUS through a network management
application. When enabled, RADIUS can authenticate users accessing the switch through the CLI.

Identifying the RADIUS Server Host

Switch-to-RADIUS-server communication involves several components:
Hostname or IP address
Authentication destination port
Accounting destination port
Key string
Timeout period
Retransmission value