7 Cisco NAS equipment has become quite popular of late, but being Cisco
8 equipment running IOS, the configuration can be a bit non-obvious to the
9 unfamiliar. This document aims to describe the most common configuration
10 options to make your Ciscos interoperate with radius as you would expect a
11 well-behaved NAS to do.
16 For Cisco 12.x ( 12.0 and 12.1 ), the following AAA configuration directives
22 aaa authentication login default group radius local
23 aaa authentication login localauth local
24 aaa authentication ppp default if-needed group radius local
25 aaa authorization exec default group radius local
26 aaa authorization network default group radius local
27 aaa accounting delay-start
28 aaa accounting exec default start-stop group radius
29 aaa accounting network default start-stop group radius
32 this configuration works very well with most radius servers. One of the more
33 important configurations is:
37 aaa accounting delay-start
39 This directive will delay the sending of the Accounting Start packet until
40 after an IP address has been assigned during the PPP negotiation process.
41 This will supersede the need to enable the sending of "Alive" packets as
42 described below for IOS versions 11.x
44 *Note* with the above it will use the radius server to authenticate
45 your inbound 'telnet' connections. You will need to create an entry
46 in your users file similar to the following to allow access:
50 !root Cleartext-Password := "somepass" Service-Type = NAS-Prompt-User
52 This will let a user in for the first level of access to your Cisco. You
53 will still need to 'enable' ( using the locally configured enable secret )
54 to perform any configuration changes or anything requiring a higher level
55 of access. The username '!root' was used as an example here, you can make
56 this any username you want, of course.
58 Unique Acct-Session-Id's
59 ^^^^^^^^^^^^^^^^^^^^^^^^
61 From: http://isp-lists.isp-planet.com/isp-australia/0201/msg05143.html
63 Just a note to all cisco ISPs out there who want RFC2866 compliance need to
64 enable the hidden command ``radius-server unique-ident <n>``
66 Minimum IOS: 12.1(4.1)T.
68 Acct-Session-Id should be unique and wrap after every 256 reboots.
70 You must reboot after entering this command to take effect. If not, you
71 will observe after 10 minutes
72 of entering this command, the following message.
76 %RADIUS-3-IDENTFAIL: Save of unique accounting ident aborted.
81 For Cisco 11.1, you normally use
86 aaa authentication ppp radppp if-needed radius
87 aaa authorization network radius none
88 aaa accounting network wait-start radius
90 to get the Cisco to talk to a radius server.
97 aaa accounting update newinfo
99 If you want the IP address of the user to show up in the radutmp file
100 (and thus, the output of "radwho").
102 This is because with IOS 11.3, the Cisco first sends a "Start" accounting
103 packet without the IP address included. By setting "update newinfo" it
104 will send an account "Alive" packet which updates the information.
106 Also you might see a lot of "duplicates" in the logfile. That can be
111 aaa accounting network wait radius
112 radius-server timeout 3
114 To disable the Ascend style attributes (which is a VERY good idea!):
118 radius-server host X.Y.Z.A auth-port 1645 acct-port 1646
120 To enable the Ascend style attributes (which we do NOT recommend!):
124 radius-server host X.Y.Z.A auth-port 1645 acct-port 1646 non-standard
126 To see Cisco-AVPair attributes in the Cisco debugging log:
128 radius-server vsa accounting
130 Cisco 36xx & 26xx, keeping the NAS IP static
131 --------------------------------------------
133 The Cisco 36/26 by default selects (it seems at random) any IP address
134 assigned to it (serial, ethernet etc.) as it's RADIUS client source
135 address, thus the access request may be dropped by the RADIUS server,
136 because it can not verify the client. To make the cisco box always use
137 one fixed address, add the following to your configuration:
141 ip radius source-interface Loopback0
143 and configure the loopback interface on your router as follows:
148 ip address 192.168.0.250 255.255.255.255
150 Use a real world IP address and check the Cisco documentation for why
151 it is a good idea to have working loopback interface configured on
154 If you don't want to use the loopback interface of course you can set
155 the source-interface to any interface on your Cisco box which has an
161 Original - Alan DeKok <aland@ox.org>
162 12.x Info - Chris Parker <cparker@starnetusa.net> 2000-10-12
166 For more information, the following page on Cisco's web site may help:
168 http://www.cisco.com/univercd/cc/td/doc/product/access/acs_serv/vapp_dev/vsaig3.htm