EasyManuals Logo

Cisco Catalyst 4500 Series Software Configuration Guide

Cisco Catalyst 4500 Series
2086 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
To Previous Page IconTo Previous Page
To Previous Page IconTo Previous Page
Page #1383 background imageLoading...
Page #1383 background image
49-103
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Controlling Switch Access with RADIUS
Identifying the RADIUS Server Host
Switch-to-RADIUS-server communication involves several components:
Hostname or IP address
Authentication destination port
Accounting destination port
Key string
Timeout period
Retransmission value
You identify RADIUS security servers by their hostname or IP address, hostname and specific UDP port numbers, or their IP
address and specific UDP port numbers. The combination of the IP address and the UDP port number creates a unique
identifier, allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service. This unique
identifier enables RADIUS requests to be sent to multiple UDP ports on a server at the same IP address.
If two different host entries on the same RADIUS server are configured for the same service—for example, accounting—the
second host entry configured acts as a failover backup to the first one. Using this example, if the first host entry fails to provide
accounting services, the
%RADIUS-4-RADIUS_DEAD message appears, and then the switch tries the second host entry configured
on the same device for accounting services. (The RADIUS host entries are tried in the order that they are configured.)
A RADIUS server and the switch use a shared secret text string to encrypt passwords and exchange responses. To configure
RADIUS to use the AAA security commands, you must specify the host running the RADIUS server daemon and a secret text
(key) string that it shares with the switch.
The timeout, retransmission, and encryption key values can be configured globally for all RADIUS servers, on a per-server
basis, or in some combination of global and per-server settings. To apply these settings globally to all RADIUS servers
communicating with the switch, use the three unique global configuration commands: radius-server timeout, radius-server
retransmit, and radius-server key. To apply these values on a specific RADIUS server, use the radius-server host global
configuration command.
Note If you configure both global and per-server functions (timeout, retransmission, and key commands) on
the switch, the per-server timer, retransmission, and key value commands override global timer,
retransmission, and key value commands. For information on configuring these settings on all RADIUS
servers, see the “Configuring Settings for All RADIUS Servers” section on page 49-110.
You can configure the switch to use AAA server groups to group existing server hosts for authentication. For more information,
see the “Defining AAA Server Groups” section on page 49-107.

Table of Contents

Other manuals for Cisco Catalyst 4500 Series

Questions and Answers:

Question and Answer IconNeed help?

Do you have a question about the Cisco Catalyst 4500 Series and is the answer not in the manual?

Cisco Catalyst 4500 Series Specifications

General IconGeneral
SeriesCatalyst 4500 Series
CategorySwitch
Layer SupportLayer 2, Layer 3
Form FactorModular chassis
StackableNo
Chassis Slots3, 6, 7, 10
Power Supply OptionsAC, DC
RedundancyPower supply, Supervisor engine
Network ManagementCisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
FeaturesSecurity, QoS
Port DensityUp to 384 ports per chassis
Security Features802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine8-E

Related product manuals