Configuring AAA Services on Cisco IOS XR Software
How to Configure AAA Services
SC-196
Cisco IOS XR System Security Configuration Guide
Configuring Per VRF AAA
The Per VRF AAA functionality enables AAA services to be based on VPN routing and forwarding
(VRF) instances. The Provider Edge (PE) or Virtual Home Gateway (VHG) communicates directly with
the customer's RADIUS server, which is associated with the customer's VPN, without having to go
through a RADIUS proxy. Thus, ISPs can scale their VPN offerings more efficiently, because they no
longer have to use RADIUS proxies and they can provide their customers with the flexibility they
demand.
New Vendor-Specific Attributes (VSAs)
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating
vendor-specific information between the network access server and the RADIUS server by using the
vendor-specific attribute (attribute 26). Attribute 26 encapsulates vendor-specific attributes, thereby,
allowing vendors to support their own extended attributes otherwise not suitable for general use.
The Cisco IOS XR RADIUS implementation supports one vendor-specific option using the format
recommended in the specification. Cisco's vendor-ID is 9, and the supported option has vendor-type 1,
which is named "cisco-avpair." The value is a string of the following format:
protocol : attribute sep value *
"Protocol" is a value of the Cisco "protocol" attribute for a particular type of authorization. “Attribute”
and “value” are an appropriate attribute-value (AV) pair defined in the Cisco TACACS+ specification,
and “sep” is “=” for mandatory attributes and “*” for optional attributes. This definition allows the full
set of features available for TACACS+ authorization to also be used for RADIUS.
Table 7 describes the VSAs that are now supported for Per VRF AAA.
SUMMARY STEPS
1. configure
2. aaa group server radius group-name
Table 7 Supported VSAs for Per VRF AAA
VSA Name
Value
Type Description
Note The RADIUS VSAs—rad-serv, rad-serv-source-if, and rad-serv-vrf—must have the prefix “aaa:” before the VSA
name.
rad-serv string Indicates the IP address, key, timeout, and retransmit number of a server and the group of
the server.
The VSA syntax follows:
rad-serv=a.b.c.d [key SomeKey] [auth-port X] [acct-port Y] [retransmit V]
[timeout W].
Other than the IP address, all parameters are optional and are issued in any order. If the
optional parameters are not specified, their default values are used.
The key cannot contain any spaces; for “retransmit V,” “V” can range from 1 to 100; for
“timeout W,” the “W” can range from 1 to 1000.
rad-serv-vrf string Specifies the name of the VRF that is used to transmit RADIUS packets. The VRF name
matches the name that was specified through the vrf command.
To Next Page
Loading...
Need help?
General
