Cisco C3201FESMIC-TP= - 3201 Fast EN Switch Mobile Interface Card Expansion Module Software Configuration Manual page 86

Configuring and Enabling RADIUS
RADIUS security servers are identified by their hostname or IP address, hostname and specific User
Datagram Protocol (UDP) port numbers, or IP address and specific UDP port numbers. The combination
of the IP address and the UDP port number creates a unique identifier allowing different ports to be
individually defined as RADIUS hosts providing a specific AAA service. This unique identifier enables
RADIUS requests to be sent to multiple UDP ports on a server at the same IP address.
If two different host entries on the same RADIUS server are configured for the same service—such as
accounting—the second host entry configured acts as a failover backup to the first one. Using this
example, if the first host entry fails to provide accounting services, the bridge tries the second host entry
configured on the same device for accounting services. (The RADIUS host entries are tried in the order
that they are configured.)
A RADIUS server and the bridge use a shared secret text string to encrypt passwords and exchange
responses. To configure RADIUS to use the AAA security commands, you must specify the host that is
running the RADIUS server daemon and a secret text (key) string that it shares with the bridge.
The timeout, retransmission, and encryption key values can be configured globally per server for all
RADIUS servers or in some combination of global and per-server settings. To apply these settings
globally to all RADIUS servers communicating with the bridge, use the three unique global
configuration commands: radius-server timeout, radius-server retransmit, and radius-server key. To
apply these values on a specific RADIUS server, use the radius-server host command in global
configuration mode.
If you configure both global and per-server functions (timeout, retransmission, and key commands) on
Note
the bridge, the per-server timer, retransmission, and key value commands override global timer,
retransmission, and key value commands. For information on configuring these setting on all RADIUS
servers, see the
You can configure the bridge to use AAA server groups to group existing server hosts for authentication.
For more information, see the
To configure per-server RADIUS server communication, follow these required steps, beginning in
privileged EXEC mode:
Command
Step 1 configure terminal
Step 2 aaa new-model
Cisco 3200 Series Wireless MIC Software Configuration Guide
22
"Configuring Settings for All RADIUS Servers" section on page
"Defining AAA Server Groups" section on page
Purpose
Enters global configuration mode.
Enables AAA.
Administering the WMIC
28.
25.