aaa authorization ipmobile
To authorize Mobile IP to retrieve security associations from the AAA server using TACACS+ or RADIUS, use the aaa authorization ipmobile command in global configuration mode. To remove authorization, use the no form of this command.
aaa authorization ipmobile { [ radius | tacacs | + ] | default } [ group server-groupname ]
no aaa authorization ipmobile { [ radius | tacacs | + ] | default } [ group server-groupname ]
Syntax Description
|
radius |
Authorization list named radius. |
|
tacacs+ |
Authorization list named tacacs+. |
|
default |
Default authorization list. |
|
group server-groupname |
(Optional) Name of the server group to use. |
Command Default
AAA is not used to retrieve security associations for authentication.
Command Modes
Global configuration
Command History
|
Release |
Modification |
|---|---|
|
12.0(1)T |
This command was introduced. |
Usage Guidelines
Mobile IP requires security associations for registration authentication. The security associations are configured on the router or on a AAA server. This command is not needed for the former; but in the latter case, this command authorizes Mobile IP to retrieve the security associations from the AAA server.
Once the authorization list is named, it can be used in other areas such as login. You can only use one named authorization list; multiple named authorization lists are not supported.
The aaa authorization ipmobile default group server-groupname command is the most commonly used method to retrieve security associations from the AAA server.
 Note |
The AAA server does not authenticate the user. It stores the security association that is retrieved by the router to authenticate registration. |
Examples
The following example uses TACACS+ to retrieve security associations from the AAA server:
aaa new-model
aaa authorization ipmobile tacacs+
tacacs-server host 1.2.3.4
tacacs-server key mykey
ip mobile host 10.0.0.1 10.0.0.5 virtual-network 10.0.0.0 255.0.0.0 aaa
The following example uses RADIUS as the default group to retrieve security associations from the AAA server:
aaa new-model
aaa authentication login default enable
aaa authorization ipmobile default group radius
aaa session-id common
radius-server host 128.107.162.173 auth-port 1645 acct-port 1646
radius-server retransmit 3
radius-server key cisco
ip mobile host 10.0.0.1 10.0.0.5 virtual-network 10.0.0.0 255.0.0.0 aaa
Feedback