7-30
Catalyst 2950 Desktop Switch Software Configuration Guide
78-14982-01
Chapter 7 Administering the Switch
Controlling Switch Access with RADIUS
For e x am ple , th e f oll owing AV pair activates C isco ’s multiple n amed ip address pools featu r e du r i ng IP
author izatio n (dur ing PPP’s IPCP address a ssignmen t):
cisco-avpair= ”ip:addr-pool=first“
The following example shows how to provide a user logging in from a switch with immediate access to
privileged EXEC commands:
cisco-avpair= ”shell:priv-lvl=15“
Other vendor s have their own uniqu e vendor-IDs, option s , and a ssoci ated V SA s. For mor e in for mat ion
about vendor-IDs and VSAs, re fer to RFC 2138, “Remote Authentication Dial-In User Service
(RADIUS).”
Beginning in privileged EXEC mode, follow th ese steps to config ure the switch to recognize and use
VSAs:
For a complete list of RADIUS attributes or more information about vendor-specific attribute 26, refer
to the “RADIUS Attributes” appendix in the Cisco IOS Security Configuration Guide for Release 12.1.

Configuring the Switch for Vendor-Proprietary RADIUS Server Communication

Although an IETF draft standard for RADIUS specifies a method for communicating vendor-proprietary
inform ation be tween th e switch an d the RADIU S server, some vendors have extended the RA DIUS
attribute set in a uniq ue way. Cisco I OS software supp orts a subs et of vendor-proprie tary RADI US
attributes.
As mentioned earlier , to configure RADIUS (whether vendor-proprietary or IETF draft-compliant), you
must specif y the host ru nning the RADIUS server da emon an d the secr et text string it share s with the
switch. You specify the RADIUS host and secret text string by using the radius-server g l obal
configurati on comm a nds.
Command Purpose
Step 1 config ure terminal Enter gl obal configura tion mode.
Step 2 radius-server vsa send [accounting |
authentication]Enable the switch to recognize and use VSAs as def ined by RADIUS IETF
attribute 26.
•(Optiona l) Us e the accounting keyword to limit the set of recognized
vendor-specific attributes to only acc ounting at tributes.
•(Optiona l) Us e the authentication key word to limit the set of
recognized vendor-specific attributes to only authentication attributes.
If you ent er this comm and witho ut keywords, both ac count ing and
authentication vendor-specific attributes are used.
Step 3 end Return to privileged EXEC mode.
Step 4 show running-config Ve rify yo ur settin gs .
Step 5 copy running-config startup-config (Opti onal) Save your entries i n the configurat ion file.