Configuring Advanced RADIUS Servers Settings

1. From the top menu, click VNS.
2. In the left pane, click Global > Authentication.
3. In the MAC Address area, click Advanced.
   

   Advanced RADIUS Server Settings

   
4. Configure the following parameters:
   

   Advanced Radius Settings

   Field	Description
   Include Service-Type attribute in Client Access Request messages	Select if the client RADIUS Access Request message includes the "Service-Type" attribute. If included, the attribute is set to "Framed" by default.
   Set Service Type to Login	If selected, the RADIUS "Service-Type" attribute of the client Access Request is set to "Login" (instead of "Framed"). Note: RADIUS-based controller administrative access also sets the Service-Type attribute to "Login". Therefore, if you enable Service Type Login here, RADIUS-based administrative access is not allowed (and vice versa).
   Delay for Client Message for Topology Change	Defines a delay during client authentication when switching from one topology to another. This is relevant for Captive Portal authentication. The delay gives time for the client to be assigned an IP address for the new topology before browser redirection. Set the delay in seconds.
   How should multiple RADIUS servers be used?	Select an authentication or accounting option. The selection applies to all WLAN (Wireless Local Area Network) Services and to all sites on the EWC. Round-Robin. The server is selected on a round-robin basis starting at the top of the list of approved servers. The first server is used until it fails, and that pattern continues down the list. When the last server fails, then the first server is used again. Primary-Backup. Select a primary failover server to have control over which server provides redundancy. When you select Primary-Backup, the RADIUS server assigned to the site or WLAN Service is the primary for the WLAN Service. All other RADIUS servers assigned to WLAN Service are backups for the primary and continue to be selected in a round-robin approach. For controllers in an availability pair, the Primary and Backup servers must be synchronized (enable "Synchronize System Configuration" in Availability setup) if the WLAN Services are synchronized. If the primary server has failed resulting in a backup server being used for authentication, the controller will periodically send a "Health Check" to the primary server to see if it has recovered. If the primary server has recovered, the controller starts using the primary server for all new authentications. All authentications in progress continue to use the backup server.
   Use MAC-Based Authentication MAC address format for user authentication and accounting via RADIUS	Allows the administrator to override the default MAC address colon-separated format (for example 00:11:22:33:44:55) with the Global Authentication MAC Address format for the following attributes: Calling-Station-Id attribute of the RADIUS packet Called-Station-Id attribute (if Called-Station-Id is not overridden by Zone name) AP BSSID Mac in one of the vendor attributes User-Name attribute. Note: This setting is enabled for new deployments. You must manually enable this setting for upgraded deployments.
   Override 802.1x Authentication Call-Station-Id format with XX-XX-XX-XX-XX-XX:SSID	Allows the administrator to override the Called-Station-Id attribute format for 802.1x authentication with the format XX-XX-XX-XX-XX-XX:SSID. This setting is disabled by default. When you select this option, the Called-Station-Id conforms to the format specified in RFC 3580 (IEEE 802.1X Remote Authentication Dial In User Service (RADIUS) Usage Guidelines). If the RADIUS server is processing this attribute, the RADIUS server has to support this format. Note: This setting overrides the setting Use MAC-Based Authentication MAC address format for user authentication and accounting via RADIUS.
   Radius Accounting	Enabling RADIUS accounting activates RADIUS accounting only in WLAN Services specifically configured to perform it. Disabling RADIUS accounting overrides the RADIUS accounting settings of individual WLAN Services.
   Defer sending the accounting start request until the client's IP address is known	Specify Authentication Behavior of RADIUS servers on Server Failure. If selected, the client RADIUS Accounting Request "start" command is not sent to the RADIUS server until the client IP address is known. By default, this option is not selected and the "start" command is sent once the client is authenticated.

5. Click Close to close the Advanced Settings dialog.
6. Click Save to save your changes.