Configuring the Radius Server Dead-Time | Cisco Systems OL-5650-02

Chapter 3 Configuring the CSS as a Client of a RADIUS Server

Configuring the RADIUS Server Dead-Time

To reset the RADIUS server retransmit request to the default of 3 retransmissions, enter:

(config)# no radius-server retransmit

Configuring the RADIUS Server Dead-Time

During the dead-time interval, the CSS sends probe access-request packets to verify that the RADIUS server (primary or secondary) is available and can receive authentication requests. The dead-time interval starts when the server does not respond to the number of authentication request transmissions configured through the radius-server retransmit command. When the server responds to a probe access-request packet, the CSS transmits the authentication request to the server.

Use the radius-serverdead-timecommand to set the time interval in which the CSS verifies whether a nonresponsive server is operational. Valid entries are 1 to 255 seconds. The default is 5 seconds.

To configure the RADIUS server dead-time to 15 seconds, with probe access-requests enabled, enter:

(config)# radius-server dead-time 15

To reset the RADIUS server dead-time request to the default of 5 seconds, enter:

(config)# no radius-server dead-time

Showing RADIUS Server Configuration Information

Use the show radius command to display information and statistics about the RADIUS server configuration. The syntax and options for the command are as follows:

•show radius config [allprimarysecondary] - Displays RADIUS configuration information for a specific server or all servers, identified by type

•show radius statistics [allprimarysecondary] - Displays RADIUS authentication statistics for a specific server or all servers, identified by type

To view the configuration for a RADIUS primary server, enter:

(config)# show radius config primary

		Cisco Content Services Switch Security Configuration Guide
		Cisco Content Services Switch Security Configuration Guide
	OL-5650-02			3-9
	OL-5650-02			3-9

Image 79

Cisco Systems OL-5650-02 manual Configuring the Radius Server Dead-Time, Config# no radius-server retransmit

Contents

Cisco Content Services Switch Security Configuration Guide Cisco Content Services Switch Security Configuration Guide Iii N T E N T S ACL Overview Configuring the CSS as a Client of a Radius Server Configuring Firewall Load Balancing Vii Example of Fwlb Viii B L E S OL-5650-02 Preface Audience How to Use This GuideXii Xiii Related Documentation Xiv Rmon Document Title Description Xvi Symbols and Conventions Cisco.com Obtaining DocumentationXvii Xviii Documentation FeedbackDocumentation DVD Ordering Documentation Cisco Product Security Overview Reporting Security Problems in Cisco ProductsXix Cisco Technical Support Website Obtaining Technical Assistance Xxi Submitting a Service Request Xxii Definitions of Service Request Severity Xxiii Xxiv Controlling CSS Access Config# username-offdm bobo password secret Changing the Administrative Username and Password Config# username picard password captain superuser Creating Usernames and Passwords Controlling CSS Access Creating Usernames and Passwords Config# no username picard Config# username picard password captain superuser NwbnnnrConfig# username picard password flute superuser Controlling Remote User Access to the CSS Configuring Virtual Authentication #config virtual authentication primary tacacs Configuring Console Authentication#config virtual authentication secondary local #config console authentication secondary local #config console authentication primary tacacs#config no console authentication Enabling Administrative Access to the CSS Controlling Administrative Access to the CSS Config# no restrict web-mgmt Disabling Administrative Access to the CSS Config# restrict telnet Controlling CSS Network Traffic Through Access Control Lists ACL Overview ACL ACL Configuration Quick Start Config-acl7#clause 15 permit any any destination any Config-acl7#clause 10 deny any any destination range 20Config-acl7#apply circuit-VLAN1 Creating an ACL Config-acl7#remove circuit-VLAN1 Config# acl disableDeleting an ACL Configuring Clauses Cisco Content Services Switch Security Configuration Guide Variables Options Parameters Destination content ownername/ rulename for an Variables OptionsParameters Show group ? Variables Options Parameters Prefer Adding a Clause When ACLs are Globally Enabled Config-acl7apply circuit-VLAN1 Config-acl7remove circuit-VLAN1Deleting a Clause Applying an ACL to a Circuit or DNS Queries Removing an ACL from Circuits or DNS Queries Enabling ACLs on the CSS Showing ACLs Disabling ACLs on the CSS Field Description Logging ACL Activity Setting the Show ACL Counters to Zero Config-acl7#clause 1 log disable Config-acl7#clause 1 log enable ACL Example Config# no logging subsystem acl Configuring Network Qualifier Lists for ACLs Describing an NQL Creating an NQLAdding Networks to an NQL Config-nqlbypassnql#no ip address 192.168.0.0/16 Config# logging subsystem nql level debug-7 Adding an NQL to an ACL Clause Showing NQL Configurations Configuring the Secure Shell Daemon Protocol # license Enabling SSH Config# no restrict ssh Configuring SSH AccessConfiguring Sshd in the CSS Configuring Sshd Keepalive Configuring Sshd Server-Keybits Configuring Sshd Port Config# sshd version Configuring Sshd VersionConfig# sshd server-keybits Config# no sshd server-keybits # show sshd config Configuring Telnet Access When Using SshdShowing Sshd Configurations Config# no restrict telnet # show sshd sessions # show sshd version Ptyfd Radius Server Configuring the CSS as a Client of a Radius Server Config# radius-server primary 172.27.56.76 secret Hello Radius Configuration Quick StartConfig# radius-server secondary 172.27.56.79 secret Hello #config virtual authentication primary radius Configuring a Radius Server for Use with the CSS Configuring Authorization Settings Configuring Authentication Settings Specifying a Primary Radius Server Config# no radius-server secondary Config# no radius-server primarySpecifying a Secondary Radius Server Config# no radius-server timeout Configuring the Radius Server TimeoutsConfiguring the Radius Server Retransmits Config# radius-server timeout Config# no radius-server dead-time Configuring the Radius Server Dead-TimeConfig# no radius-server retransmit Config# radius-server dead-time DOWN, Unknown Config# show radius statistics secondary 3describes the fields in the show radius statistics output OL-5650-02 TACACS+ Server TACACS+ Configuration Quick Start Config# show tacacs-server Configuring Authorization Settings Configuring Global TACACS+ Attributes #config tacacs-server timeout Setting the Global CSS TACACS+ Timeout Period#config no tacacs-server timeout #config no tacacs-server key Setting the Global TACACS+ Keepalive Frequency#config tacacs-server key market #config tacacs-server key acskefterefesdtx Defining a TACACS+ Server Config# no tacacs-server frequency OL-5650-02 #config no tacacs-server 192.168.11.1 Setting TACACS+ Authorization #config no tacacs-server authorize non-config #config tacacs-server authorize config#config tacacs-server authorize non-config #config no tacacs-server authorize config Setting TACACS+ Accounting Showing TACACS+ Server Configuration Information Field Description OL-5650-02 Configuring Firewall Load Balancing Overview of Fwlb Firewall Synchronization Configuring Fwlb Config# ip firewall 1 192.168.27.1 192.168.28.1 Configuring a Keepalive Timeout for a FirewallConfig# no ip firewall Config# ip firewall timeout Configuring an IP Static Route for a FirewallConfig# no ip firewall timeout Config# ospf redistribute firewall metric 3 type1 Configuring Ospf to Advertise Firewall RoutesConfig# ip route 192.168.2.0/24 firewall 1 Config# no ip route 192.168.2.0/24 firewall Config# rip redistribute firewall Configuring RIP to Advertise Firewall RoutesExample of Fwlb Static Route Configuration Config# no ospf redistribute firewall Config# ip route 0.0.0.0/0 firewall Config# ip firewall 1 192.168.28.1 192.168.27.1Config# ip route 192.168.2.0/24 firewall Config# ip firewall 2 192.168.28.2 192.168.27.2 Example of Fwlb Configuring Fwlb with VIP and Virtual Interface Redundancy Fwlb with VIP/Interface Redundancy Configuration Cisco Content Services Switch Security Configuration Guide CSS-OUT-L Configuration Example of Firewall and Route Configurations CSS-IN-L Configuration Config# show flows Config# show flows 192.165.22.1Displaying Firewall Flow Summaries Displaying Firewall IP Routes Config# show ip routes firewall Displaying Firewall IP Information Config# show ip firewall OL-5650-02 IN-1 D E IN-2 IN-3 FTP IN-4 Radius IN-5 XML IN-6