AAA-Domain Stripping at Server Group Level

The AAA-Domain Stripping at Server Group Level feature allows domain stripping to be configured at the server group level.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Information About AAA-Domain Stripping at Server Group Level

You can remove the domain name from the username received at the global level by using the radius-server domain-stripping command. When the radius-server domain-stripping command is configured, all the AAA requests with “user@example.com” go to the remote RADIUS server with the reformatted username “user”. The domain name is removed from the request.


Note

Domain stripping will not be done in a TACACS configuration.

The AAA Broadcast Accounting feature allows accounting information to be sent to multiple AAA servers at the same time, that is, accounting information can be broadcast to one or more AAA servers simultaneously. This functionality allows you to send accounting information to private and public AAA servers. It also provides redundant billing information for voice applications.

You can configure domain stripping at the server group level by using the domain-stripping command in server group RADIUS configuration mode. Per-server group configuration overrides the global configuration. If domain stripping is not enabled globally, but it is enabled in a server group, then it is enabled only for that server group. Also, if virtual routing and forwarding (VRF)-specific domain stripping is configured globally and in a server group for a different VRF, domain stripping is enabled in both the VRFs. VRF configurations are taken from server-group configuration mode. If server-group configurations are disabled in global configuration mode but are available in server-group configuration mode, all configurations in server-group configuration mode are applicable.

After the domain stripping and broadcast accounting are configured, you can create separate accounting records as per the configurations.

How to Configure AAA-Domain Stripping at Server Level Group

Configuring Domain Stripping at the Server Group Level

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. aaa new-model
  4. aaa group server radius server-name
  5. domain-stripping [strip-suffix word] [right-to-left ] [prefix-delimiter word] [delimiter word]
  6. end

DETAILED STEPS

  Command or Action Purpose
Step 1

enable

Example:

Device> enable
Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

aaa new-model

Example:

Device(config)# aaa new-model

Enables AAA.

Step 4

aaa group server radius server-name

Example:

Device(config)# aaa group server radius rad1
Adds the RADIUS server and enters server group RADIUS configuration mode.

  • The server-name argument specifies the RADIUS server group name.

Step 5

domain-stripping [strip-suffix word] [right-to-left ] [prefix-delimiter word] [delimiter word]

Example:

Device(config-sg-radius)# domain-stripping delimiter username@example.com

Configures domain stripping at the server group level.

Step 6

end

Example:

Device(config-sg-radius)# end

Exits server group RADIUS configuration mode and returns to the privileged EXEC mode.

Configuration Example for AAA-Domain Stripping at Server Group Level

Example: AAA-Domain Stripping at Server Group Level

The following example shows the domain stripping configuration at the server group level: 


Device> enable
Device# configure terminal
Device(config)# aaa new-model
Device(config)# aaa group server radius rad1
Device(config-sg-radius)# domain-stripping right-to-left delimiter @$/
Device(config-sg-radius)# end

Additional References

The following sections provide references related to the Configuring Authentication feature.

Related Documents

Related Topic

Document Title

Authorization

Configuring Authorization in the Cisco IOS XE Security Configuration Guide: Securing User Services, Release 2.

Accounting

Configuring Accounting in the Cisco IOS XE Security Configuration Guide: Securing User Service , Release 2.

Security commands

Cisco IOS Security Command Reference

Standards

Standard

Title

No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

--

MIBs

MIB

MIBs Link

No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

To locate and download MIBs for selected platforms, Cisco IOS XE software releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

RFC

Title

RFC 1334

PPP Authentication Protocols

RFC 2433

Microsoft PPP CHAP Extensions

RFC 2903

Generic AAA Architecture

RFC 2904

AAA Authorization Framework

RFC 2906

AAA Authorization Requirements

RFC 2989

Criteria for Evaluating AAA Protocols for Network Access

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

http://www.cisco.com/techsupport

Feature Information for AAA-Domain Stripping at Server Group Level

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1. Feature Information for AAA-Domain Stripping at Server Group Level

Feature Name

Releases

Feature Information

AAA-Domain Stripping at Server Group Level

Cisco IOS XE Release 3.4S

The AAA-Domain Stripping at Server Group Level feature allows domain stripping to be configured at the server group level.

The following command was introduced: domain-stripping .