13-6
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter13 Configuring RADIUS and TACACS+ Servers
Configuring and Enabling RADIUS
Command Purpose
Step1 configure terminal Enter global configuration mode.
Step2 aaa new-model Enable AAA.
Step3 radius-server {hostname |
ip-address}[auth-port port-number]
[acct-port port-number] [timeout
seconds] [retransmit retries] [key
string]
Note This command was supported in
the older releases. You are
recommended to use the
following new commands.
These series of new commands have
been introduced in this release to replace
earlier command:
radius server name
address [IP address ip-address]
[auth-port port-number] [acct-port
port-number]
address {ipv4
radius-server-IPv4-Address | ipv6
radius-server-IPv6-Address}
Specify the server name of the remote RADIUS server host.
•(Optional) For auth-port port-number, specify the UDP destination
port for authentication requests.(Optional) For acct-port
port-number, specify the UDP destination port for accounting
requests.
•(Optional) For timeout seconds, specify the time interval that the
access point waits for the RADIUS server to reply before
retransmitting. The range is 1 to 1000. This setting overrides the
radius-server timeout global configuration command setting. If no
timeout is set with the radius-server host command, the setting of
the radius-server timeout command is used.
•(Optional) For retransmit retries, specify the number of times a
RADIUS request is resent to a server if that server is not responding
or responding slowly. The range is 1 to 1000. If no retransmit value is
set with the radius-server host command, the setting of the
radius-server retransmit global configuration command is used.
•(Optional) For key string, specify the authentication and encryption
key used between the access point and the RADIUS daemon running
on the RADIUS server.
Note The key is a text string that must match the encryption key used
on the RADIUS server. Always configure the key as the last item
in the radius-server host command. Leading spaces are ignored,
but spaces within and at the end of the key are used. If you use
spaces in your key, do not enclose the key in quotation marks
unless the quotation marks are part of the key.
To configure the access point to recognize more than one host entry
associated with a single IP address, enter this command as many times as
necessary, making sure that each UDP port number is different. The
access point software searches for hosts in the order in which you specify
them. Set the timeout, retransmit, and encryption key values to use with
the specific RADIUS host.
Step4 dot11 ssid ssid-string Enter SSID configuration mode for an SSID on which you need to enable
accounting. The SSID can consist of up to 32 alphanumeric characters.
SSIDs are case sensitive.
Step5 accounting list-name Enable RADIUS accounting for this SSID. For list-name, specify the
accounting method list. Click this URL for more information on method
lists:
http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/gu
ide/fsecur_c/scfacct.html
Note To enable accounting for an SSID, you must include the
accounting command in the SSID configuration. Click this URL
to browse to a detailed description of the SSID configuration
mode accounting command.