Cisco Systems ONS 15310-CL Deadtime minutes, Marked as dead, the skipping will not take place

Chapter 16 Configuring Security for the ML-Series Card

RADIUS Stand Alone Mode

	Command	Purpose
Step 5
	Router (config)# radius-server	Specify the number of minutes to mark as "dead" any RADIUS servers that
	deadtime minutes	fail to respond to authentication requests. A RADIUS server marked as
		"dead" is skipped by additional authentication requests for the specified
		number of minutes. This allows trying the next configured server without
		having to wait for the request to time out before. If all RADIUS servers are
		marked as "dead," the skipping will not take place.
		The default is 0; the range is 1 to 1440 minutes.
Step 6
	Router (config)# end	Return to privileged EXEC mode.
Step 7
	Router# show running-config	Verify your settings.
Step 8
	Router# copy running-config	(Optional) Save your entries in the configuration file.
	startup-config

To return to the default setting for the retransmit, timeout, and deadtime, use the no forms of these commands.

Configuring the ML-Series Card to Use Vendor-Specific RADIUS Attributes

The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific information between the ML-Series card and the RADIUS server by using the vendor-specific attribute (attribute 26). Vendor-specific attributes (VSAs) allow vendors to support their own extended attributes that are not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific option by using the format recommended in the specification. Cisco’s vendor-ID is 9, and the supported option has vendor-type 1, which is named cisco-avpair. The value is a string with this format:

protocol : attribute sep value *

Protocol is a value of the Cisco protocol attribute for a particular type of authorization. Attribute and value are an appropriate attribute-value (AV) pair defined in the Cisco Terminal Access Controller Access Control System Plus (TACACS+) specification, and sep is the character = for mandatory attributes and the character * for optional attributes. The full set of features available for TACACS+ authorization can then be used for RADIUS.

For example, this AV pair activates Cisco’s multiple named ip address pools feature during IP authorization (during point-to-point protocol [PPP] internet protocol control protocol (IPCP) address assignment):

cisco-avpair=”ip:addr-pool=first“

This example shows how to specify an authorized VLAN in the RADIUS server database:

cisco-avpair=”tunnel-type(#64)=VLAN(13)”

cisco-avpair=”tunnel-medium-type(#65)=802 media(6)”

cisco-avpair=”tunnel-private-group-ID(#81)=vlanid”

This example shows how to apply an input access control list (ACL) in ASCII format to an interface for the duration of this connection:

cisco-avpair=“ip:inacl#1=deny ip 10.10.10.10 0.0.255.255 20.20.20.20 255.255.0.0”

cisco-avpair=“ip:inacl#2=deny ip 10.10.10.10 0.0.255.255 any”

cisco-avpair=“mac:inacl#3=deny any any decnet-iv”

This example shows how to apply an output ACL in ASCII format to an interface for the duration of this connection:

		Cisco ONS 15310-CL, ONS 15310-MA, and ONS 15310-MA SDH Ethernet Card Software Feature and Configuration Guide, R9.1 and R9.2
16-18	78-19415-01