Cisco 4700M Configuration Manual page 98

Configuring the ACE as a Client of a RADIUS, TACACS+, or LDAP Server
Configuring the RADIUS NAS-IP-Address Attribute
Setting the Global RADIUS Server Preshared Key
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
2-28
Typically, RADIUS servers check the source IP address in the IP header of the
RADIUS packets to track the source of the RADIUS requests. Also, some servers
use the NAS-IP-Address RADIUS attribute to identify the RADIUS clients that
can expose your ACE internal private network interface IP addresses.
By default, the NAS-IP-Address is not configured. The ACE performs a route
lookup on the RADIUS server IP address and uses the result. Use the
radius-server attribute nas-ipaddr command to specify a RADIUS
NAS-IP-Address attribute. This attribute allows you to configure an arbitrary IP
address to be used as RADIUS attribute 4, NAS-IP-Address for each context. The
radius-server attribute nas-ipaddr command allows the ACE to behave as a
single RADIUS client from the perspective of the RADIUS server. The configured
NAS-IP-Address is encapsulated in all outgoing RADIUS authentication request
and accounting packets.
The syntax of this command is as follows:
radius-server attribute nas-ipaddr nas_ip_address
The nas_ip_address argument configures an IP address to be used as the RADIUS
NAS-IP-Address, attribute 4.
For example, to specify a RADIUS NAS-IP-Address, enter:
host1/Admin(config)# radius-server attribute nas-ipaddr 192.168.1.1
To delete the RADIUS NAS-IP-Address and return to the default configuration,
enter:
host1/Admin(config)# no radius-server attribute nas-ipaddr 192.168.1.1
You can globally configure an authentication key for communication between the
ACE and the RADIUS daemon running on each RADIUS server by using the
radius-server key command. The key is a text string that must match the
encryption key used on the RADIUS server. RADIUS keys are always stored in
encrypted form in persistent storage on the ACE. This global key is applied to
those RADIUS servers in a named server group for which a shared secret is not
individually configured by the radius-server host command.
Chapter 2 Configuring Authentication and Accounting Services
OL-16202-01