Verification - Cisco Catalyst 2000 Configuration Handbook

182 Cisco LAN Switching Configuration Handbook
b. Enable RADIUS authentication for user level:
c. Specify the RADIUS key:

Verification

To verify configuration of authentication, use the following commands:
show radius statistics
show tacacs
Feature Example
This example shows the configuration for a switch that uses a RADIUS server with the
address 192.168.1.10 as the primary authentication method for Telnet users and a
TACACS server with the address 192.168.1.8 for the primary authentication method for
console users. The TACACS key will be abc123, and the radius key will be 789xyz.
An example of the configuration follows:
Switch# conf t
Switch (config)# aaa new-model
Switch (config)# ip radius source-interface Interface Gig1/1/1
Switch (config)# radius-server host 192.168.1.10
Switch (config)# radius-server key 789xyz
Switch (config)# aaa authentication login default group radius
Switch (config)# line con 0
This command specifies the address of the RADIUS server. This assumes that the
switch has been configured for an IP address and has a gateway if necessary to
reach the server. You can specify multiple servers in case one of the devices is
not functioning.
(global) aaa authentication login {default | group | radius}
After you specify the server address, you set the user-level authentication
process to use the radius option for the console, telnet, http, or all services. The
primary option for this command specifies that RADIUS is the first authentica-
tion method. If that fails, other authentication methods, such as local login, are
attempted.
(global) radius-server host {hostname | ip-address} [auth-port port-
number] [acct-port port-number]
radius-server key string
Because the information between the RADIUS device and the switch is encrypt-
ed, you must also supply the RADIUS process with the key that is used by the
server. This command specifies the key used.