Cisco Catalyst 4500 Series - Configuring Multiple Domain Authentication and Multiple Authorization

49-34
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
This example shows how to specify the server with IP address 172.120.39.46 as the RADIUS server. The first command
specifies port 1612 as the authorization port, sets the encryption key to rad123.
The second command dictates that key matches are performed on the RADIUS server:
Switch# configure terminal
Switch(config)# radius-server host 172.l20.39.46 auth-port 1612 key rad123
Switch(config)# ip radius source-interface g3/2
Switch(config)# end
Switch#
You can globally configure the timeout, retransmission, and encryption key values for all RADIUS servers by using the
radius-server host global configuration command. If you want to configure these options on a per-server basis, use the
radius-server timeout, radius-server retransmit, and the radius-server key global configuration commands.
You also need to create a AAA client setting on the RADIUS server. These settings include the IP address of the switch and
the key string to be shared by both the server and the switch.
Configuring Multiple Domain Authentication and Multiple Authorization
Note Multiple Authorization requires Cisco IOS Release 12.2(50)SG and later releases.
To configure Multiple Domain Authentication (MDA) and Multiple Authorization, perform this task.
Step 5
Switch(config)# ip radius
source-interface m/p
Establishes the IP address to be used as the source address for all
outgoing RADIUS packets.
Step 6
Switch(config)# end
Returns to privileged EXEC mode.
Step 7
Switch# show running-config
Verifies your entries.
Step 8
Switch# copy running-config
startup-config
(Optional) Saves your entries in the configuration file.
Command Purpose
Step 1
Switch# configure terminal
Enters global configuration mode.
Step 2
Switch(config)# radius-server vsa
send authentication
Configures the network access server to recognize and use
vendor-specific attributes (VSAs).
Step 3
Switch(config)# interface
interface-id
Specifies the port to which multiple hosts are indirectly attached, and
enters interface configuration mode.
Command Purpose