Add a RADIUS Server

Before you begin

If you specify an FQDN for the server, you must configure DNS for address resolution.

About this task

Add a RADIUS server to provide RADIUS service on the switch.

Procedure

  1. In the navigation pane, expand Configuration > Security > Control Path.
  2. Select RADIUS.
  3. Select the RADIUS Servers tab.
  4. Select Insert.
  5. Select a value for AddressType.
  6. In Address, type the address or FQDN.
  7. In UsedBy, select the RADIUS server purpose.
  8. Optional: Configure optional parameters as required.
  9. Select Insert.

RADIUS Servers Field Descriptions

Use the data in the following table to use the RADIUS Servers tab.

Name

Description

AddressType

Specifies the address type as either an IPv4 address, IPv6 address, or dns for a Fully Qualified Domain Name (FQDN).

Address

Specifies the IP address or FQDN of the RADIUS server.

UsedBy

Configures how the server functions:

  • cli—configure the server for CLI authentication.

  • eapol—configure the server for EAPoL authentication.

  • endpointTracking—configure the server for Endpoint Tracking authentication.

  • snmp—configure the server for SNMP accounting.

  • web—configure the server for HTTP(s) authentication.

The default is cli.

Priority

Specifies the priority of each server, or the order of servers to send authentication. The default is 10.

TimeOut

Specifies the time interval in seconds before the client retransmits the packet. The default is 8.

Enable

Enables or disables authentication on the server. The default is true.

MaxRetries

Specifies the maximum number of retransmissions allowed. The default is 1.

UdpPort

Specifies the UDP port that the client uses to send requests to the server. The default value is 1812.

The UDP port value set for the client must match the UDP value set for the RADIUS server.

SecretKey

Specifies the RADIUS server secret key, which is the password used by the client to be validated by the server.

AcctEnable

Enables or disable RADIUS accounting. The default is true.

AcctUdpPort

Specifies the UDP port of the RADIUS accounting server. The default value is 1813.

The UDP port value configured for the client must match the UDP value configured for the RADIUS server.

SecureEnable

Enable RADIUS Security (RADSec). The default is disabled.

SecureMode

Specifies the RADSec security mode. Possible values are:

  • tls - Transport Layer Security (TLS) encryption over Transmission Control Protocol (TCP)
  • dtls - Datagram Transport Layer Security (DTLS) encryption over User Datagram Protocol (UDP)

The default is tls.

Important:
To avoid TLS handshake issues if the switch and RADsec proxy server run different versions of OpenSSL, manually force TLS version 2 negotiation through the RADsec proxy by adding the following text to the radsecproxy.conf configuration file: 
tls default{
     ...         
     TlsVersion TLS1_2
}

SecureProfile

Specifies the name of the secure profile.

SecureLogLevel

Specifies the log severity level. Possible values are :

  • critical

  • error

  • warning

  • info

  • debug

The default is error.
9037809-01 Rev AA