7-27
Catalyst 2950 Desktop Switch Software Configuration Guide
78-14982-01
Chapter 7 Adminis tering the Switch Controlling Switch Access with RADIUS
To remove the specified RADIUS server, use the no radius-server host hostname | ip- address global
configurati on comm and. To remove a server gro up from t he configurati on list, use the no aaa group
server ra diu s group-name g l obal configu ratio n c omma nd . To r emove the I P a ddr ess of a R ADI US
server, use the no server ip-addres s ser ver group co nfiguration co mman d.
In this example, the switch is configured to recognize two dif ferent RADIUS group servers (group1 and
group2). Group1 has two different host entries on the same RADIUS server configured for the same
services. The second host entry acts as a fail-over backup to the first entry.
Switch(config)# radius-server host 172.20.0.1 auth-port 1000 acct-port 1001
Switch(config)# radius-server host 172.10.0.1 auth-port 1645 acct-port 1646
Switch(config)# aaa new-model
Switch(config)# aaa group server radius group1
Switch(config-sg-radius)# server 172.20.0.1 auth-port 1000 acct-port 1001
Switch(config-sg-radius)# exit
Switch(config)# aaa group server radius group2
Switch(config-sg-radius)# server 172.20.0.1 auth-port 2000 acct-port 2001
Switch(config-sg-radius)# exit

Configuring RADIUS Authorization for User Privileged Access and Network Services

AAA auth orization limits the services available to a user. When AAA authorization is en abled, the
switch uses information retrieved from the user’s profile, which is in the lo cal us er datab ase or on the
security server, to configure the user’s session. The user is granted access to a requested serv ice only if
the information in the user profile allows it.
You can use the aaa aut horizat ion globa l c onfigurat ion com ma nd with the radius keyword to set
parameters that restrict a user’s network access to privileged EXEC mode.
The aaa authorization exec radius local command sets these authorization parameters:
•Use RADIUS f or privileged EXEC access authorization if authentication was performed by using
RADIUS.
•Use the local database if authentication was not performed by using RADIUS.
Note Au thor izat ion i s bypasse d fo r au the ntic ate d u ser s who l og in thro ugh the CLI even if auth ori zat ion has
been c onfigu red.
Step 8 copy running-config startup-config (Optiona l) Save your entries in the co nfigurati on file.
Step 9 Enable RADIUS login au thentication. See the “Configuring RADIUS
Login Authen tication” section on page 7-23.
Command Purpose