To configure subinterfaces such as Ethernet, virtual LANs (VLAN), stacked VLAN (Q-in-Q), virtual circuit (VC), and VC ranges, use the radius attribute nas-port-type command in subinterface configuration mode. To disable the subinterface configuration, use the no form of this command.

Syntax Description

Command Default

NAS-Port-Type is not configured.

Command Modes

Subinterface configuration

Command History

Usage Guidelines

You can override the attribute 61 configured globally at a subinterface level.

To set a different extended attribute 61 value for a subinterface, such as for Ethernet, VLAN, Q-in-Q, VC, or VC ranges, select a value for that port type. An extended attribute 61 setting at a subinterface level will override the global extended attribute 61 value.

Related Commands

To enable an incoming RADIUS packet to bypass the IP path, use the radius ip-input-bypass command in global configuration mode. To disable the RADIUS packet bypass configuration, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

The incoming RADIUS packet is enabled to bypass the IP path.

Command Modes

        Global configuration (config)
      

Command History

Usage Guidelines

Use the radius ip-input-bypass command to let the incoming RADIUS packets bypass the IP path in the device. The bypass configuration reduces the overall latency and helps packets reach the RADIUS module in the device faster.

Related Commands

To specify the name for the RADIUS server configuration for Protected Access Credential (PAC) provisioning, use the radius server command in global configuration mode. To delete the specified RADIUS server configuration name, use the noform of this command.

Syntax Description

Command Default

No RADIUS server configuration name for PAC provisioning is specified.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The radius server command enters RADIUS server configuration mode where PAC provisioning parameters can be configured for the named RADIUS server. The aaa new-model command must be configured before accessing this command.

To check the available options in this mode, type ? after entering into RADIUS server configuration mode (config-radius-server).

Related Commands

To enable the router to send a system accounting record for the addition and deletion of a RADIUS server, use the radius-server accounting system host-configcommand in global configuration mode.

To to disable system accounting records, use the no form of this command:

Command Default

The command-level defaul t is not enabled.

Command Modes

Global configuration mode (config)

Command History

Usage Guidelines

The radius-server accounting system host-config command is used when configuring RADIUS system accounting on the global RADIUS server.

Related Commands

To configure an IP address for the RADIUS attribute 4 address, use the radius-server attribute 4 command in global configuration mode. To delete an IP address as the RADIUS attribute 4 address, use the no form of this command.

Syntax Description

Command Default

If this command is not configured, the RADIUS NAS-IP-Address attribute will be the IP address on the interface that connects the network access server (NAS) to the RADIUS server.

Command Modes

Global configuration

Command History

Usage Guidelines

Normally, when the ip radius-source interface command is configured, the IP address on the interface that is specified in the command is used as the IP address in the IP headers of the RADIUS packets and as the RADIUS attribute 4 address inside the RADIUS packets.

However, when the radius-server attribute 4 command is configured, the IP address in the command is used as the RADIUS attribute 4 address inside the RADIUS packets. There is no impact on the IP address in the IP headers of the RADIUS packets.

If both commands are configured, the IP address that is specified in the radius-server attribute 4 command is used as the RADIUS attribute 4 address inside the RADIUS packets. The IP address on the interface that is specified in the ip radius-source interface command is used as the IP address in the IP headers of the RADIUS packets.

Some authentication, authorization, and accounting (AAA) clients (such as PPP, virtual private dial-up network [VPDN] or Layer 2 Tunneling Protocol [L2TP], Voice over IP [VoIP], or Service Selection Gateway [SSG]) may try to set the RADIUS attribute 4 address using client-specific values. For example, on an L2TP network server (LNS), the IP address of the L2TP access concentrator (LAC) could be specified as the RADIUS attribute 4 address using a VPDN or L2TP command. When the radius-server attribute 4 command is configured, the IP address specified in the command takes precedence over all IP addresses from AAA clients.

During RADIUS request retransmission and during RADIUS server failover, the specified IP address is always chosen as the value of the RADIUS attribute 4 address.

Related Commands

To provide for the presence of the Service-Type attribute (attribute 6) in RADIUS Access-Accept messages, use the radius-server attribute 6command in global configuration mode. To make the presence of the Service-Type attribute optional in Access-Accept messages, use the no form of this command.

Syntax Description

Command Default

If this command is not configured, the absence of the Service-Type attribute is ignored, and the authentication or authorization does not fail. The default for the voice keyword is 12.

Command Modes

Global configuration

Command History

Usage Guidelines

If this command is configured and the Service-Type attribute is absent in the Access-Accept message packets, the authentication or authorization fails.

The support-multiple keyword allows for multiple instances of the Service-Type attribute to be present in an Access-Accept packet. The default behavior is to disallow multiple instances, which results in an Access-Accept packet containing multiple instances being treated as though an Access-Reject was received.

To send the IP address of a user to the RADIUS server in the access request, use the radius-server attribute 8 include-in-access-req command in global configuration mode. To disable sending of the user IP address to the RADIUS server during authentication, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

The user IP address is not sent to the RADIUS server during authentication.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Using the radius-server attribute 8 include-in-access-req command makes it possible for a network access server (NAS) to provide the RADIUS server with a hint of the user IP address in advance of user authentication. An application can be run on the RADIUS server to use this hint and build a table (map) of user names and addresses. Using the mapping information, service applications can begin preparing user login information to have available upon successful user authentication.

When a network device dials in to a NAS that is configured for RADIUS authentication, the NAS begins the process of contacting the RADIUS server in preparation for user authentication. Typically, the IP address of the dial-in host is not communicated to the RADIUS server until after successful user authentication. Communicating the device IP address to the server in the RADIUS access request allows other applications to begin to take advantage of that information.

As the NAS is setting up communication with the RADIUS server, the NAS assigns an IP address to the dial-in host from a pool of IP addresses configured at the specific interface. The NAS sends the IP address of the dial-in host to the RADIUS server as attribute 8. At that time, the NAS sends other user information, such as the username, to the RADIUS server.

After the RADIUS server receives the user information from the NAS, it has two options:

• If the user profile on the RADIUS server already includes attribute 8, the RADIUS server can override the IP address sent by the NAS with the IP address defined as attribute 8 in the user profile. The address defined in the user profile is returned to the NAS.

• If the user profile does not include attribute 8, the RADIUS server can accept attribute 8 from the NAS, and the same address is returned to the NAS.

The address returned by the RADIUS server is saved in memory on the NAS for the life of the session. If the NAS is configured for RADIUS accounting, the accounting start packet sent to the RADIUS server includes the same IP address as in attribute 8. All subsequent accounting packets, updates (if configured), and stop packets will also include the same IP address as in attribute 8.

Note

Configuring the NAS to send the host IP address in the RADIUS access request assumes that the login host is configured to request an IP address from the NAS server. It also assumes that the login host is configured to accept an IP address from the NAS. In addition, the NAS must be configured with a pool of network addresses at the interface supporting the login hosts.

In both scenarios, use the aaa accounting delay-start extended-time delay-value command to delay the Internet Protocol Control Protocol Version 6 (IPCPv6) address negotiation using the configured delay value. During the delay, the IPCPv4 address is sent to the RADIUS server and the Framed-IP-Address attribute is added to the accounting start packet.

Related Commands

To specify the default direction of filters from RADIUS, use the radius-server attribute 11 default directioncommand in global configuration mode. To remove this functionality from your configuration, use the no form of this command.

Syntax Description

Command Default

This command is disabled by deault.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use the radius-server attribute 11 default directioncommand to change the default direction of filters from RADIUS (RADIUS attribute 11 (Filter-Id) indicates the name of the filter list for the user). Enabling this command allows you to change the filter direction to inbound--which stops traffic from entering a router and prevents resource consumption--rather than keeping the outbound default direction, where filtering occurs only as the traffic is about to leave the network.

To include the class attribute in access-request, use the radius-server attribute 25command in global configuration mode. To disable class RADIUS configuration, use the no form of this command.

Syntax Description

Command Default

The class atrribute in access-request is not included.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Attribute 25 refers to class attribute.

Related Commands

To allow network providers to accurately match the billing function with the actual number dialed (Original Called Number (OCN)), and not the translated number to which the switch reports, use the radius-server attribute 30 original-called-number command in global configuration mode.

Command Default

The command-level defaul t is not enabled. The translated number is sent to the NAS.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The ITU-T Q.931 attribute is the connection control protocol of the ISDN. Some switches can send a translated dialed number identification service (DNIS) number to the network access server (NAS) instead of the OCN. These switches eventually inform the NAS about the OCN in its Q931 attribute. However, some network providers require the OCN in its Q.931 attribute.

The radius-server attribute 30 original-called-numbercommand allows the OCN with its Q.931 attribute to be sent to the RADIUS Called-Station-ID, which is a check mechanism administrators use to deny or accept access from users based on the NAS (when available). This OCN is used instead of the redirected translated number reported as the DNIS by ISDN.

To configure Calling-Station-ID (attribute 31) options, use the radius-server attribute 31command in global configuration mode. To disable the Calling-Station-ID (attribute 31) options, use the no form of this command.

Syntax Description

Command Default

The Calling-Station-ID (attribute 31) is not sent.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

• For PPP over Ethernet over ATM (PPPoEoA) sessions:

When the send nas-port-detail keyword and the mac-only option are configured, the Calling-Station-ID (attribute 31) information is sent in Access and Accounting requests in the following format:

host.domain:vp_descr:vpi:vci

• For PPP over Ethernet over Ethernet (PPPoEoE) sessions:

When the send nas-port-detail keyword and the mac-only option are configured, the Calling-Station-ID (attribute 31) information is sent in Access and Accounting requests in the following format:

mac_addr

• For PPP over ATM sessions:

When the send nas-port-detail keyword and the mac-only option are configured, the Calling-Station-ID (attribute 31) information is sent in Access and Accounting requests in the following format:

host.domain:vp_descr:vpi:vci

• For Intelligent Services Gateway RADIUS Proxy sessions:

When DHCP lease query is used, ISG RADIUS proxy recieves MAC address as well as MSISDN as the Calling-Station-ID (attribute 31) from the downstream device. Therefore, ISG RADIUS proxy must be configured to choose one of them as the Calling Station ID and send it to the ISG accounting records.

The following example shows how to specify the MAC address in the Calling Station ID to be displayed in IETF format:

Router(config)# radius-server attribute 31 mac format
 ietf

The following example shows how to allow the remote ID to be sent as the Calling Station ID:

Router(config)# radius-server attribute 31 remote-id

The following example shows how to allow the NAS port details to be included in the Calling Station ID:

Router(config)# radius-server attribute 31 send nas-port-detail

The following example shows how to allow only the MAC address, if available, to be included in the Calling-Station-ID:

Router(config)# radius-server attribute 31 send nas-port-detail mac-onl

Related Commands

To configure a nondefault MAC address format in the calling line ID (CLID) of a DHCP accounting packet, use the radius-server attribute 31 mac format command in global configuration mode. To revert to the default MAC address format, use the no form of this command.

Syntax Description

Command Default

The MAC address format in the CLID is set to the default format.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The CLID (attribute 31) carries information such as phone numbers, IP addresses, and MAC addresses.

The CLID is sent in the DHCP accounting packet only if the radius-server attribute 31 send nas-port-detail mac-only command is also configured along with the radius-server attribute 31 mac format command.

Related Commands

To send RADIUS attribute 32 (NAS-Identifier) in an access-request or accounting-request, use the radius-server attribute 32 include-in-access-req command in global configuration mode. To disable sending RADIUS attribute 32, use the no form of this command.

Syntax Description

Command Default

RADIUS attribute 32 is not sent in access-request or accounting-request packets.

Command Modes

Global configuration

Command History

Usage Guidelines

Using the radius-server attribute 32 include-in-access-req command makes it possible to identify the network access server (NAS) manufacturer to the RADIUS server by sending RADIUS attribute 32 (NAS-Identifier) in an access-request or accounting-request. If you configure the format argument, the string sent in attribute 32 will include an IP address, a hostname, or a domain name; otherwise, the Fully Qualified Domain Name (FQDN) is sent by default.

To add the accounting IP address before the existing session ID, use the radius-server attribute 44 extend-with-addr command in global configuration mode. To remove this command from your configuration, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

This command is not enabled.

Command Modes

Global configuration

Command History

Usage Guidelines

The radius-server attribute 44 extend-with-addrcommand adds Acct-Session-Id (attribute 44) before the existing session ID (NAS-IP-Address).

When multiple network access servers (NAS) are being processed by one offload server, enable this command on all NASs and the offload server to ensure a common and unique session ID.

Note	This command should be enabled only when offload servers are used.

Related Commands

To send RADIUS attribute 44 (accounting session ID) in access-request packets before user authentication (including requests for preauthentication), use the radius-server attribute 44 include-in-access-req command in global configuration mode. To remove this command from the configuration, use the no form of this command.

Syntax Description

Command Default

RADIUS attribute 44 is not sent in access-request packets.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The accounting session IDs may not increment uniformly and consistently; that is, between two calls, the accounting session ID can increase by more than one.

The vrf vrf-name keyword and argument specify Accounting Session IDs per VRF, which allows multiple, disjoined routing or forwarding tables, where the routes of one user have no correlation with the routes of another user.

Related Commands

To configure the offload server to synchronize accounting session information with the network access server (NAS) clients, use the radius-server attribute 44 sync-with-client command in global configuration mode. To disable this functionality , use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

This command is not enabled.

Command Modes

Global configuration

Command History

Usage Guidelines

Use the radius-server attribute 44 sync-with-client command to allow the offload server to synchronize accounting session information with the NAS clients. The NAS-IP-Address, the Acct-Session-Id, and the Class attribute are transmitted from the client to the offload server via Layer 2 Forwarding (L2F) options.

Related Commands

To send the RADIUS attribute 55 (Event-Timestamp) in accounting packets, use the radius-server attribute 55 include-in-acct-req command in global configuration mode. To remove this command from your configuration, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

RADIUS attribute 55 is not sent in accounting packets.

Command Modes

Global configuration

Command History

Usage Guidelines

Use the radius-server attribute 55 include-in-acct-reqcommand to send RADIUS attribute 55 (Event-Timestamp) in accounting packets . The Event-Timestamp attribute records the time that the event occurred on the NAS; the timestamp sent in attribute 55 is in seconds since January 1, 1970 00:00 UTC.

Note

Before the Event-Timestamp attribute can be sent in accounting packets, you >must configure the clock on the router. (For information on setting the clock on your router, refer to section “Performing Basic System Management” in the chapter “ System Management ” of the Cisco IOS Configuration Fundamentals and Network Management Configuration Guide .) To avoid configuring the clock on the router every time the router is reloaded, you can enable the clock calendar-valid command. (For information on this command, refer to the Cisco IOS Config uration Fundamentals and Network Management Command Reference. )

Related Commands

To authenticate user credentials by sending a Challenge Handshake Authentication Protocol (CHAP)-Challenge (RADIUS attribute 60) in access-request packets to the RADIUS server, use the radius-server attribute 60 include-in-access-req command in global configuration mode. To disable this configuration, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

RADIUS attribute 60 is not sent in access-request packets to the RADIUS server.

Command Modes

        Global configuration (config)
      

Command History

Usage Guidelines

Use the radius-server attribute 60 include-in-access-req command to identify the network access server (NAS) manufacturer by sending RADIUS attribute 60 (CHAP-Challenge) in an access-request. If the CHAP-Challenge value is 16 octets long, this value can either be included in the CHAP-Challenge attribute or it can be entered in the Request Authenticator field of the access-request packet.

Related Commands

To enable extended, non-RFC-compliant NAS-Port-Type attribute (RADIUS attribute 61), use the radius-server attribute 61 extendedcommand in global configuration mode. To disable extended, non-RFC-compliant NAS-Port-Type attribute (RADIUS attribute 61), use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

Extended attribute 61 is disabled by default.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

RADIUS Attribute 61 (Network-attached storage (NAS) port-type, a number) is sent in an access-request to indicate the type of physical port of the NAS, which is authenticating the user with number.

The Value “Virtual” refers to a connection to the NAS through a transport protocol, instead of through a physical port. For example, if a user telnetted into a NAS, the value “Virtual” would be reflected as the NAS value.

There is no specific NAS value for IP sessions. The NAS value depends on the underlying transport technology values described in the table below or “Virtual” is used for IP sessions. For example, if PPP is the underlying access technology (transport protocol), the value reported is 33.

If extended attribute 61 is not enabled the following occurs:

• All PPPoA, PPPoE, PPPoEoE, PPPoEoA sessions are identified as “Virtual”.

• All PPPoEoVLAN and PPPoEoQinQ sessions are identified as VLAN.

• RFC-compliant values, such as Virtual (value 5) and Ethernet (value 15) are sent to the authentication, authorization, and accounting (AAA) records.

Related Commands

To identify the hostname or address of the network access server (NAS) at the initiator end of the Point-to-Point Tunneling Protocol (PPTP) tunnel by sending the Tunnel-Client-Endpoint attribute in access-request packets to the RADIUS server, use the radius-server attribute 66 include-in-access-req command in global configuration mode. To disable the Tunnel-Client-Endpoint attribute, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

RADIUS attribute 66 is not sent in access-request packets to the RADIUS server.

Command Modes

        Global configuration (config)
      

Command History

Usage Guidelines

VPNs use Layer 2 Forwarding (L2F) or Layer 2 Tunnel Protocol (L2TP) tunnels to tunnel the link layer of high-level protocols (for example, PPP or asynchronous High-Level Data Link Control [HDLC]). ISPs configure their network access servers to receive calls from users and forward the calls to the customer tunnel server. Usually, the ISP maintains only information about the tunnel endpoint. The customer maintains IP addresses, routing, and other user database functions of the tunnel server users. Use the radius-server attribute 66 include-in-access-req command to identify the hostname or address of the NAS at the initiator end of the tunnel by sending RADIUS attribute 66 (Tunnel-Client-Endpoint) in an access-request packet. The tunnel information in the access-request packet allows the provider to know which PPTP service (for example, L2TP) was selected.

Related Commands

To identify the hostname or address of the network access server (NAS) at the sever end of the Point-to-Point Tunneling Protocol (PPTP) tunnel by sending the Tunnel-Server-Endpoint attribute in access-request packets to the RADIUS server, use the radius-server attribute 67 include-in-access-req command in global configuration mode. To disable the Tunnel-Server-Endpoint attribute, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

RADIUS attribute 67 is not sent in access-request packets to the RADIUS server.

Command Modes

        Global configuration (config)
      

Command History

Usage Guidelines

VPNs use Layer 2 Forwarding (L2F) or Layer 2 Tunnel Protocol (L2TP) tunnels to tunnel the link layer of high-level protocols (for example, PPP or asynchronous High-Level Data Link Control [HDLC]). ISPs configure their network access servers to receive calls from users and forward the calls to the customer tunnel server. Usually, the ISP maintains only information about the tunnel endpoint. The customer maintains IP addresses, routing, and other user database functions of the tunnel server users. Use the radius-server attribute 67 include-in-access-req command to specify the hostname or address of the NAS at the server end of the tunnel by sending RADIUS attribute 67 (Tunnel-Server-Endpoint) in an access-request packet. The tunnel information in the access-request packet allows the provider to know which PPTP service (for example, L2TP) was selected.

Related Commands

To receive nonencrypted tunnel passwords in attribute 69 (Tunnel-Password) , use the radius-server attribute 69 clear command in global configuration mode. To disable this feature and receive encrypted tunnel passwords, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

RADIUS attribute 69 is not sent and encrypted tunnel passwords are sent.

Command Modes

Global configuration

Command History

Usage Guidelines

Use the radius-server attribute 69 clearcommand to receive nonencrypted tunnel passwords, which are sent in RADIUS attribute 69 (Tunnel-Password). This command allows tunnel passwords to be sent in a “string” encapsulated format, rather than the standard tag/salt/string format, which enables the encrypted tunnel password.

Some RADIUS servers do not encrypt Tunnel-Password; however the current NAS (network access server) implementation will decrypt a non-encrypted password that causes authorization failures. Because nonencrypted tunnel passwords can be sent in attribute 69, the NAS will no longer decrypt tunnel passwords.

Note	Once this command is enabled, all tunnel passwords received will be nonencrypted until the command is manually disabled.

To send connection speed information to the RADIUS server in the access request, use the radius-server attribute 77 command in global configuration mode. To prevent connection speed information from being included in the access request, use the no form of this command.

Syntax Description

Command Default

RADIUS attribute 77 is sent to the RADIUS server in the access request.

Command Modes

Global configuration

Command History

Usage Guidelines

RADIUS attribute 77 is sent to the RADIUS server in the access request by default.

RADIUS attribute 77 allows RADIUS authentication based on connection speed. Sessions can be accepted or denied based on the allowed connection speed configured for a particular user on the RADIUS server.

RADIUS attribute 77 includes the following information:

• The accounting start/stop request

• The VC class name defined with the class-intcommand

• The VC class name defined with the class-vc command

• The VC class name defined with the class-range command

The VC class name may include letters, numbers, and the characters “:” (colon), “;” (semicolon), “-” (hyphen) and “,” (comma).

Related Commands

To send the number of remaining links in the multilink bundle in the accounting-request packet, use the radius-server attribute 188 format non-standard command in global configuration mode. To disable the sending of the number of links in the multilink bundle in the accounting-request packet, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

RADIUS attribute 188 is not sent in accounting “start” and “stop” records.

Command Modes

Global configuration

Command History

Usage Guidelines

Use this command to send attribute 188 in accounting “start” and “stop” records.

Note	Effective with Cisco IOS Release 12.4, the radius-server attribute data-rate send 0 command is not available in Cisco IOS software.

To enable the data transmit and receive rate of RADIUS server attributes 197 and 255 in accounting records, use the radius-server attribute data-rate send 0 command in global configuration mode.

Syntax Description

This command has no arguments or keywords.

Command Default

The default value for RADIUS server attributes 197 and 255 is zero.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

RADIUS attribute 197 is the Ascend-Data-Rate in an accounting-request packet. This attribute specifies the receive baud rate of the connection in bits per second over the course of the connection's lifetime.

RADIUS attribute 255 is the Ascend-Xmit-Rate in an accounting-request packet. This attribute specifies the transmit baud rate of the connection in bits per second over the course of the connection’s lifetime.

The connection is authenticated for both RADIUS attributes 197 and 255 if the following conditions are met:

• The session has ended or has failed to authenticate because the accounting-request packet has the RADIUS attribute: Acct-Status-Type=Stop.

• The Auth parameter is set to a value other than RADIUS or LOGOUT.

Note	RADIUS attribute 197 does not appear in the user profile.

To define an accept or reject list name, use the radius-server attribute list command in global configuration mode. To remove an accept or reject list name from your configuration, use the no form of this command.

Syntax Description

Command Default

List names are not defined.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

A user may configure an accept or reject list with a selection of attributes on the network access server (NAS) for authorization or accounting so unwanted attributes are not accepted and processed. The radius-server attribute list command allows users to specify a name for an accept or reject list. This command is used in conjunction with the attribute(server-group configuration) command, which adds attributes to an accept or reject list.

Note	The list name must be the same as the list name defined in the accountingor authorizationconfiguration command.

Related Commands

The radius-server attribute nas-port extended command is replaced by the radius-server attribute nas-port format command. See the description of the radius-server attribute nas-port format command for more information.

To set the NAS-Port format used for RADIUS accounting features and restore the default NAS-port format, or to set the global attribute 61 session format e string or configure a specific service port type for attribute 61 support, use the radius-server attribute nas-port format command in global configuration mode. To stop sending attribute 61 to the RADIUS server, use the no form of this command.

Syntax Description

Command Default

Standard NAS-Port format for NAS-Port for RADIUS accounting features and restoring default NAS-Port format or extended NAS-Port support.

Command Modes

Global configuration

Command History

Usage Guidelines

The radius-server attribute nas-port format command configures RADIUS to change the size and format of the NAS-Port attribute field (RADIUS IETF attribute 5).

The following NAS-Port formats are supported:

• Standard NAS-Port format--This 16-bit NAS-Port format indicates the type, port, and channel of the controlling interface. This is the default format used by Cisco IOS software.

• Extended NAS-Port format--The standard NAS-Port attribute field is expanded to 32 bits. The upper 16 bits of the NAS-Port attribute display the type and number of the controlling interface; the lower 16 bits indicate the interface that is undergoing authentication.

• Shelf-slot NAS-Port format--This 16-bit NAS-Port format supports expanded hardware models requiring shelf and slot entries.

• PPP extended NAS-Port format--This NAS-Port format uses 32 bits to indicate the interface, virtual path identifier (VPI), and virtual channel indicator (VCI) for PPPoA and PPPoEoA, and the interface and VLAN ID for PPPoE over Institute of Electrical and Electronic Engineers (IEEE) standard 802.1Q VLANs.

Format e

Before Cisco IOS Release 12.2(4)T formats a through c did not work with Cisco platforms such as the AS5400. For this reason, a configurable format e was developed. Format e requires you to explicitly define the usage of the 32 bits of attribute 25 (NAS-Port). The usage is defined with a given parser character for each NAS-Port field of interest for a given bit field. By configuring a single character in a row, such as x, only one bit is assigned to store that given value. Additional characters of the same type, such as x, will provide a larger available range of values to be stored. The table belowshows how the ranges may be expanded:

It is imperative that you know what the valid range is for a given parameter on a platform that you want to support. The Cisco IOS RADIUS client will bitmask the determined value to the maximum permissible value on the basis of configuration. Therefore, if one has a parameter that turns out to have a value of 8, but only 3 bits (xxx) are configured, 8 and 0x7 will give a result of 0. Therefore, you must always configure a sufficient number of bits to capture the value required correctly. Care must be taken to ensure that format e is configured to properly work for all NAS port types within your network environment.

The table below shows the supported parameters and their characters:

All 32 bits that represent the NAS-Port must be set to one of the above characters because this format makes no assumptions for empty fields.

Access Router

The DS0 port on a T1-based card and on a T3-based card will give different results. On T1-based cards, the physical port is equal to the virtual port (because these are the same). So, p and d will give the same information for a T1 card. However, on a T3 system, the port will give you the physical port number (because there can be more than one T3 card for a given platform). As such, d will give you the virtual T1 line (as per configuration on a T3 controller). On a T3 system, p and d will be different, and one should capture both to properly identify the physical device. As a working example for the Cisco AS5400, the following configuration is recommended:

Router (config)# radius-server attribute nas-port format e SSSSPPPPPPPPPsssspppppccccc

This will give one an asynchronous slot (0-16), asynchronous port (0-512), DS0 slot (0-16), DS0 physical port (0-32), DS0 virtual port (0-32), and channel (0-32). The parser has been implemented to explicitly require 32-bit support, or it will fail.

Finally, format e is supported for channel-associated signaling (CAS), PRI, and BRI-based interfaces.

Note	This command replaces the radius-server attribute nas-port extended command.

Extended NAS-Port-Type Attribute Support

This command allows you to configure a specific service port type for extended attribute 61 support which overrides the default global setting.

Related Commands

To set the default framed protocol in the RADIUS packet to Point-toPoint Protocol (PPP), use the radius-server authorizationcommand in global configuration mode. To disable the authorization, use the no form of this command.

Syntax Description

Command Default

The defualt framed protocol in the RADIUS packet to PPP is not set.

Command Modes

Global configuration (config)

Command History

Related Commands

The radius-server authorization missing Service-Type command is replaced by the radius-server attribute 6command. See the radius-server attribute 6command for more information.

To configure the router for exponential backoff retransmit of accounting requests, use the radius-server backoff exponential command in global configuration mode. To disable this functionality, use the no form of this command.

Syntax Description

Command Default

This command is not enabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The radius-server backoff exponential command is used to keep accounting records on a router for up to 24 hours. After enabling this command, the router will try to send the normal retransmissions for the number of times the retransmits argument is configured. Thereafter, the router will continue to retransmit accounting requests with an interval that doubles on each retransmit failure until a configured maximum interval is reached.

While the router is in “retransmit mode,” it will store all accounting records that are generated during that period in its memory; the accounting records will be sent to the RADIUS server after the router comes back up before the retransmit mode is complete.

Related Commands

To prevent user responses to Access-Challenge packets from being displayed on the screen, use the radius-server challenge-noecho command in global configuration mode . To return to the default condition, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

All user responses to Access-Challenge packets are echoed to the screen.

Command Modes

Global configuration

Command History

Usage Guidelines

This command applies to all users. When the radius-server challenge-noecho command is configured, user responses to Access-Challenge packets are not displayed unless the Prompt attribute in the user profile is set to >echo on the RADIUS server. The Prompt attribute in a user profile overrides the radius-server challenge-noecho command for the individual user. For more information, see the chapter “Configuring RADIUS” in the Cisco IOS Security Configuration Guide.

To have the Cisco router or access server query the vendor-proprietary RADIUS server for the static routes and IP pool definitions used throughout its domain when the device starts up, use the radius-server configure-nas command in global configuration mode. To discontinue the query of the RADIUS server, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

No default behavior or values.

Command Modes

Global configuration

Command History

Usage Guidelines

Use the radius-server configure-nas command to have the Cisco router query the vendor-proprietary RADIUS server for static routes and IP pool definitions when the router first starts up. Some vendor-proprietary implementations of RADIUS let the user define static routes and IP pool definitions on the RADIUS server instead of on each individual network access server in the network. As each network access server starts up, it queries the RADIUS server for static route and IP pool information. This command enables the Cisco router to obtain static routes and IP pool definition information from the RADIUS server.

Note	Because the radius-server configure-nas command is performed when the Cisco router starts up, it will not take effect until you issue a copy system:running-config nvram:startup-config command.

Related Commands

To force one or both of the criteria--used to mark a RADIUS server as dead--to be the indicated constant, use the radius-server dead-criteria command in global configuration mode. To disable the criteria that were set, use the no form of this command.

Syntax Description

Command Default

The number of seconds and number of consecutive timeouts that occur before the RADIUS server is marked as dead will vary, depending on the transaction rate of the server and the number of configured retransmissions.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Note	Both the time criterion and the tries criterion must be met for the server to be marked as dead.

The no form of this command has the following cases:

• If neither the seconds nor the number-of-tries argument is specified with the no radius-server dead-criteriacommand, both time and tries will be reset to their defaults.

• If the seconds argument is specified using the originally set value, the time will be reset to the default value range (10 to 60).

• If the number-of-tries argument is specified using the originally set value, the number of tries will be reset to the default value range (10 to 100).

Related Commands

To improve RADIUS response time when some servers might be unavailable and to skip unavailable servers immediately, use the radius-server deadtime command in global configuration mode. To set deadtime to 0, use the no form of this command.

Syntax Description

Command Default

Dead time is set to 0.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use this command to enable the Cisco IOS software to mark as “dead” any RADIUS servers that fail to respond to authentication requests, thus avoiding the wait for the request to time out before trying the next configured server. A RADIUS server marked as “dead” is skipped by additional requests for the specified duration (in minutes) or unless there are no servers not marked as “dead.”

Note	If a RADIUS server that is marked as “dead” receives a directed-request, the directed- request is not omitted by the RADIUS server. The RADIUS server continues to process the directed-request because the request is directly sent to the RADIUS server.

When the RADIUS Server Is Marked As Dead

For Cisco IOS versions prior to 12.2(13.7)T, the RADIUS server will be marked as dead if a packet is transmitted for the configured number of retransmits and a valid response is not received from the server within the configured timeout for any of the RADIUS packet transmissions.

For Cisco IOS versions 12.2(13.7)T and later, the RADIUS server will be marked as dead if both of the following conditions are met:

1. A valid response has not been received from the RADIUS server for any outstanding transaction for at least the timeout period that is used to determine whether to retransmit to that server, and

2. At at least the requisite number of retransmits plus one (for the initial transmission) have been sent consecutively across all transactions being sent to the RADIUS server without receiving a valid response from the server within the requisite timeout.

Related Commands

To allow users to log in to a Cisco network access server (NAS) and select a RADIUS server for authentication, use the radius-server directed-requestcommand in global configuration mode. To disable the directed-request function, use the no form of this command.

Syntax Description

Command Default

The User cannot log in to a Cisco NAS and select a RADIUS server for authentication.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The radius-server directed-request command sends only the portion of the username before the “@” symbol to the host specified after the “@” symbol. In other words, with this command enabled, you can direct a request to any of the configured servers, and only the username is sent to the specified server.

Note	If a private RADIUS server is used as the group server by configuring the server-private (RADIUS) command, then the radius-server directed-requestcommand cannot be configured.

The following is the sequence of events to send a message to RADIUS servers:

• If the radius-server directed-request command is configured:

  • A request is sent to the directed server. If there are more servers with the same IP address, the request is sent only to the first server with same IP address.
  • If a response is not received, requests will be sent to all servers listed in the first method list.
  • If no response is received with the first method, the request is sent to all servers listed in the second method list until the end of the method list is reached.

Note	To select the directed server, search the first server group in the method list for a server with the IP address provided in a directed request. If it is not available, the first server group with the same IP address from the global pool is considered.

• Ifthe radius-server directed-request restricted command is configured for every server group in the method list, until the response is received from the directed server or the end of method list is reached, the following actions occur:

  • The first server with an IP address of the directed server will be used to send the request.
  • If a server with the same IP address is not found in the server group, then the first server in the global pool with the IP address of the directed-server will be used.

If the radius-server directed-requestcommand is disabled using the no radius-server directed-request command, the entire string, both before and after the “@” symbol, is sent to the default RADIUS server. The router queries the list of servers, starting with the first one in the list. It sends the whole string, and accepts the first response from the server.

Use the radius-server directed-request restricted command to limit the user to the RADIUS server identified as part of the username.

If the user request has a server IP address, then the directed server forwards it to a specific server before forwarding it to the group. For example, if a user request such as user@10.0.0.1 is sent to the directed server, and if the IP address specified in this user request is the IP address of a server, the directed server forwards the user request to the specific server.

If a directed server is configured both on the server group and on the host server, and if the user request with the configured server name is sent to the directed server, the directed server forwards the user request to the host server before forwarding it to the server group. For example, if a user request of user@10.0.0.1 is sent to the directed server and 10.0.0.1 is the host server address, then the directed server forwards the user request to the host server before forwarding the request to the server group.

Note	When the no radius-server directed-request restricted command is entered, only the restricted flag is removed, and the directed-request flag is retained. To disable the directed-request function, you must also enter the no radius-server directed-requestcommand.

Related Commands

To configure a network access server (NAS) to strip suffixes, or to strip both suffixes and prefixes from the username before forwarding the username to the remote RADIUS server, use the radius-server domain-stripping command in global configuration mode. To disable a stripping configuration, use the no form of this command.

Note	The ip vrf default command must be configured in global configuration mode before the radius-server domain-stripping command is configured to ensure that the default VRF name is a NULL value until the defaulf vrf name is configured.

Syntax Description

Command Default

Stripping is disabled. The full username is sent to the RADIUS server.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use the radius-server domain-stripping command to configure the NAS to strip the domain from a username before forwarding the username to the RADIUS server. If the full username is user1@cisco.com, enabling the radius-server domain-stripping command results in the username “user1” being forwarded to the RADIUS server.

Use the right-to-leftkeyword to specify that the username should be parsed for a delimiter from right to left, rather than from left to right. This allows strings with two instances of a delimiter to strip the username at either delimiter. For example, if the username is user@cisco.com@cisco.net, the suffix could be stripped in two ways. The default direction (left to right) would result in the username “user” being forwarded to the RADIUS server. Configuring the right-to-leftkeyword would result in the username “user@cisco.com” being forwarded to the RADIUS server.

Use the prefix-delimiter keyword to enable prefix stripping and to specify the character or characters that will be recognized as a prefix delimiter. The first configured character that is parsed will be used as the prefix delimiter, and any characters before that delimiter will be stripped.

Use the delimiter keyword to specify the character or characters that will be recognized as a suffix delimiter. The first configured character that is parsed will be used as the suffix delimiter, and any characters after that delimiter will be stripped.

Use strip-suffix suffixto specify a particular suffix to strip from usernames. For example, configuring the radius-server domain-stripping strip-suffix cisco.netcommand would result in the username user@cisco.net being stripped, while the username user@cisco.com will not be stripped. You may configure multiple suffixes for stripping by issuing multiple instances of the radius-server domain-stripping command. The default suffix delimiter is the @ character.

Note

Issuing the radius-server domain-stripping s trip-suffix suffix command disables the capacity to strip suffixes from all domains. Both the suffix delimiter and the suffix must match for the suffix to be stripped from the full username. The default suffix delimiter of @ will be used if you do not specify a different suffix delimiter or set of suffix delimiters using the delimiterkeyword.

To apply a domain-stripping configuration only to a specified VRF, use the vrf vrf-name option.

The interactions between the different types of domain stripping configurations are as follows:

• You may configure only one instance of the radius-server domain-stripping[right-to-left] [prefix-delimiter character [character2...character7]] [delimiter character [character2...character7]]command.

• You may configure multiple instances of the radius-server domain-stripping[right-to-left] [prefix-delimiter character [character2...character7]] [delimiter character [character2...character7]] [vrf vrf-name]command with unique values for vrf vrf-name.

• You may configure multiple instances of the radius-server domain-stripping strip-suffix suffix[vrf per-vrf]command to specify multiple suffixes to be stripped as part of a global or per-VRF ruleset.

• Issuing any version of the radius-server domain-strippingcommand automatically enables suffix stripping using the default delimiter character @ for that ruleset, unless a different delimiter or set of delimiters is specified.

• Configuring a per-suffix stripping rule disables generic suffix stripping for that ruleset. Only suffixes that match the configured suffix or suffixes will be stripped from usernames.

Related Commands

The radius-server extended-portnames command is replaced by the radius-server attribute nas-port format command. See the description of the radius-server attribute nas-port format command for more information.

Note	The radius-server host command is deprecated from Cisco IOS Release 15.4(2)S. To configure an IPv4 or IPv6 RADIUS server, use the radius server name command. For more information about the radius server command, see Cisco IOS Security Command Reference: Commands M to R.

To specify a RADIUS server host, use the radius-server host command in global configuration mode. To delete the specified RADIUS host, use the no form of this command.

Syntax Description

Command Default

No RADIUS host is specified and RADIUS server load balancing automated testing is disabled by default.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

You can use multiple radius-server host commands to specify multiple hosts. The software searches for hosts in the order in which you specify them.

If no host-specific timeout, retransmit, or key values are specified, the global values apply to each host.

We recommend the use of a test user who is not defined on the RADIUS server for the automated testing of the RADIUS server. This is to protect against security issues that can arise if the test user is not configured correctly.

If you configure one RADIUS server with a nonstandard option and another RADIUS server without the nonstandard option, the RADIUS server host with the nonstandard option does not accept a predefined host. However, if you configure the same RADIUS server host IP address for different UDP destination ports, where one UDP destination port (for accounting requests) is configured using the acct-port keyword and another UDP destination port (for authentication requests) is configured using the auth-port keyword with and without the nonstandard option, the RADIUS server does not accept the nonstandard option. This results in resetting all the port numbers. You must specify a host and configure accounting and authentication ports on a single line.

To use separate servers for accounting and authentication, use the zero port value as appropriate.

RADIUS Server Automated Testing

When you use the radius-server host command to enable automated testing for RADIUS server load balancing:

• The authentication port is enabled by default. If the port number is not specified, the default port number (1645) is used. To disable the authentication port, specify the ignore-auth-port keyword.
• The accounting port is enabled by default. If the port number is not specified, the default port number (1645) is used. To disable the accounting port, specify the ignore-acct-port keyword.

Related Commands

To identify that the security server is using a vendor-proprietary implementation of RADIUS, use the radius-server host non-standardcommand in global configuration mode. This command tells the Cisco IOS software to support nonstandard RADIUS attributes. To delete the specified vendor-proprietary RADIUS host, use the no form of this command.

Syntax Description

Command Default

No RADIUS host is specified.

Command Modes

Global configuration

Command History

Usage Guidelines

The radius-server host non-standard command enables you to identify that the RADIUS server is using a vendor-proprietary implementation of RADIUS. Although an IETF draft standard for RADIUS specifies a method for communicating information between the network access server and the RADIUS server, some vendors have extended the RADIUS attribute set in a unique way. This command enables the Cisco IOS software to support the most common vendor-proprietary RADIUS attributes. Vendor-proprietary attributes will not be supported unless you use the radius-server host non-standardcommand.

For a list of supported vendor-specific RADIUS attributes, refer to the appendix “RADIUS Attributes” in the Cisco IOS Security Configuration Guide.

Related Commands

Note	The radius-server key command is deprecated from Cisco IOS Release 15.4(2)S. To configure an IPv4 or IPv6 RADIUS server, use the radius server name key command. For more information about the key (config-radius-server) command, see Cisco IOS Security Command Reference: Commands D to L.

To set the authentication and encryption key for all RADIUS communications between the router and the RADIUS daemon, use the radius-server key command in global configuration mode. To disable the key, use the no form of this command.

Syntax Description

Command Default

The authentication and encryption key is disabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

After enabling authentication, authorization, and accounting (AAA) authentication with the aaa new-model command, you must set the authentication and encryption key using the radius-server key command.

Note	Specify a RADIUS key after you issue the aaa new-model command.

The key entered must match the key used on the RADIUS daemon. All leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key.

Related Commands

To enable RADIUS server load balancing for the global RADIUS server group referred to as “radius” in the authentication, authorization and accounting (AAA) method lists, use the radius-server load-balance command in global configuration mode. To disable RADIUS server load balancing, use the no form of this command.

Syntax Description

Command Default

If this command is not configured, global RADIUS server load balancing will not occur.

Command Modes

Global configuration

Command History

Related Commands

To enable the access point or wireless-aware router as a local authentication server and to enter into configuration mode for the authenticator, use the radius-server localcommand in global configuration mode. To remove the local RADIUS server configuration from the router or access point, use the noform of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

No default behavior or values

Command Modes

Global configuration

Command History

Usage Guidelines

This command is not supported on bridges.

Related Commands

To specify the encryption of the expiration time (expiry) and password for the Protected Access Credentials (PAC) in the RADIUS local server, use the radius local-server pac-generate expirycommand in privileged EXEC mode.

Syntax Description

Command Default

The expiry encryption for PAC in the RADIUS local server is one day.

Command Modes

Privileged EXEC (#)

Command History

Related Commands

To specify that the first RADIUS request to a RADIUS server be made >without password verification, use the radius-server optional-passwords command in global configuration mode. To restore the default, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

Disabled

Command Modes

Global configuration

Command History

Usage Guidelines

When the user enters the login name, the login request is transmitted with the name and a zero-length password. If accepted, the login procedure completes. If the RADIUS server refuses this request, the server software prompts for a password and tries again when the user supplies a password. The RADIUS server must support authentication for users without passwords to make use of this feature.

To specify the number of times the Cisco IOS software searches the list of RADIUS server hosts before giving up, use the radius-server retransmit command in global configuration mode. To disable retransmission, use the no form of this command.

Syntax Description

Command Default

The default number of retransmission attempts is 3.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The Cisco IOS software tries all servers, allowing each one to time out before increasing the retransmit count.

If the RADIUS server is only a few hops from the router, we recommend that you configure the RADIUS server retransmit rate to 5.

Related Commands

To specify the reordering of RADIUS traffic retries among a server group, use the radius-server retry method reorder command in global configuration mode. To disable the reordering of retries among the server group, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

If this command is not configured, RADIUS traffic is not reordered among the server group.

Command Modes

Global configuration

Command History

Usage Guidelines

Use this command to reorder RADIUS traffic to another server in the server group when the first server fails in periods of high load. Subsequent to the failure, all RADIUS traffic is directed to the new server. Traffic is switched from the new server to another server in the server group only if the new server also fails. Traffic will not be automatically switched back to the first server.

If the radius-server retry method reordercommand is not configured, each RADIUS server is used until marked dead. The nondead server that is closest to the beginning of the list is used for the first transmission of a transaction and for the configured number of retransmissions. Each nondead server in the list is thereafter tried in turn.

Related Commands

To enable 200 ports in the range from 21645 to 21844 to be used as the source ports for sending out RADIUS requests, use the radius-server source-ports extended command in global configuration mode. To return to the default setting, in which ports 1645 and 1646 are used as the source ports for RADIUS requests, use the no form of this command.