Cisco Systems 3750E Controlling Switch Access with Kerberos, Displaying the Radius Configuration

Chapter 9 Configuring Switch-Based Authentication

Controlling Switch Access with Kerberos

As mentioned earlier, to configure RADIUS (whether vendor-proprietary or IETF draft-compliant), you must specify the host running the RADIUS server daemon and the secret text string it shares with the switch. You specify the RADIUS host and secret text string by using the radius-serverglobal configuration commands.

Beginning in privileged EXEC mode, follow these steps to specify a vendor-proprietary RADIUS server host and a shared secret text string:

	Command	Purpose
Step 1
	configure terminal	Enter global configuration mode.
Step 2
	radius-server host {hostname ip-address}non-standard	Specify the IP address or hostname of the remote
		RADIUS server host and identify that it is using a
		vendor-proprietary implementation of RADIUS.
Step 3
	radius-server key string	Specify the shared secret text string used between the
		switch and the vendor-proprietary RADIUS server.
		The switch and the RADIUS server use this text
		string to encrypt passwords and exchange responses.
		Note The key is a text string that must match the
		encryption key used on the RADIUS server.
		Leading spaces are ignored, but spaces within
		and at the end of the key are used. If you use
		spaces in your key, do not enclose the key in
		quotation marks unless the quotation marks
		are part of the key.
Step 4
	end	Return to privileged EXEC mode.
Step 5
	show running-config	Verify your settings.
Step 6
	copy running-config startup-config	(Optional) Save your entries in the configuration file.

To delete the vendor-proprietary RADIUS host, use the no radius-server host {hostname ip-address} non-standardglobal configuration command. To disable the key, use the no radius-server key global configuration command.

This example shows how to specify a vendor-proprietary RADIUS host and to use a secret key of rad124 between the switch and the server:

Switch(config)# radius-server host 172.20.30.15 nonstandard

Switch(config)# radius-server key rad124

Displaying the RADIUS Configuration

To display the RADIUS configuration, use the show running-configprivileged EXEC command.

Controlling Switch Access with Kerberos

This section describes how to enable and configure the Kerberos security system, which authenticates requests for network resources by using a trusted third party. To use this feature, the cryptographic (that is, supports encryption) versions of the switch software must be installed on your switch.

Catalyst 3750-E and 3560-E Switch Software Configuration Guide

OL-9775-02 9-31