Creating and Managing RADIUS Profiles
Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized authentication, authorization, and accounting (AAA) management for computers to connect and use a network service. By default, RADIUS servers are used for both accounting and authentication. From Network Director, you can create and manage RADIUS profiles that configure RADIUS server settings.
In addition to your RADIUS server, you can configure an LDAP server for either wireless and EX Series ELS switch authentication—for directions, see Creating and Managing LDAP Profiles.
This topic describes:
Managing RADIUS Profiles
From the Manage RADIUS Profiles page, you can:
Create a new profile by clicking Add. For directions, see Creating RADIUS Profiles.
Modify an existing profile by selecting it and clicking Edit.
View information about a profile by selecting the group and clicking Details or by clicking the profile name.
Delete profiles by selecting the profile and clicking Delete.
You cannot delete profiles that are in use—that is, assigned to objects or used by other profiles. To see the current assignments for a profile, select the profile and click Details.
Clone a profile by selecting the profile and clicking Clone.
Table 1 describes the information provided about RADIUS profiles on the Manage RADIUS Profiles page. This page lists all RADIUS profiles defined for your network, regardless of your current selected scope in the network view.
Table 1: RADIUS Profile Information
RADIUS Profile Name
Name given to the RADIUS profile when it was created.
IP address of the RADIUS server.
UDP port being used by the RADIUS server.
Date and time when this profile was created.
Date and time when this profile was last modified.
The username of the user who created or modified the profile.
All columns may not be currently displayed. To show or hide fields in the table, click the down arrow on the field header, select Columns, and select or clear the check box adjacent to the field that you want to show or hide.
Creating RADIUS Profiles
To create a RADIUS profile:
- Click in the Network Director banner.
- Under Select View, select either Logical View, Location View, Device View or Custom
Do not select Dashboard View, Datacenter View or Topology View.
- From the Tasks pane, select the type of network (Wired or Wireless), the appropriate functional area (System, AAA, or Wireless), and select the name of the profile that you want to create. For example, to create a radius profile for a wireless device, click Wireless > AAA > Radius. The Manage Profile page opens.
- Click Add on the Manage RADIUS Profiles page.
The Create RADIUS Profile page appears.
- Enter settings for the RADIUS profile on the Create RADIUS Profile page as described in Specifying Settings for a RADIUS Profile.
- Click Done.
Specifying Settings for a RADIUS Profile
Use the Create RADIUS Profile page to define authentication, authorization, and accounting settings for a RADIUS server.
Table 2 describes the RADIUS profile settings.
Table 2: RADIUS Profile Settings
Type a name for the server, using up to 64 alphanumeric characters and no special characters other than the underscore. The name must be unique among servers.
Type the IP address of the RADIUS server.
Using the arrows, adjust the number of the UDP port to use for RADIUS authentication messages. The default UDP port is 1812, and the range is from 0 to 65535.
Provide a password for the RADIUS server.
You can change the advanced settings for a RADIUS server, or you can use the default settings.
Using the arrows, adjust the number of the UDP port to use for RADIUS accounting messages. The default UDP port is 1813, and the range is from 0 to 65535.
Using the arrows, adjust the retry count until it reflects the number of times Network Director retries connecting to the RADIUS server when the RADIUS server is unavailable.
Using the arrows, adjust the timeout value. Timeout indicates how many seconds Network Director allows for RADIUS server connection before giving an unreachable error.
Using the arrows, adjust the number of seconds before Network Director checks a RADIUS server that was previously unresponsive. The default value is 5 seconds.
Use MAC as Password
Enable this option if you want each client device to use its MAC address as its password for the RADIUS server. If you enable Use MAC As Password, then the Authorization Password field becomes unavailable.
If you are not using MAC addresses as passwords for the RADIUS server, provide a common password here.
MAC Address Format
Select None, Hyphens, Colons, One-Hyphen, or Raw to determine the MAC address format used with the RADIUS server. For example:
Select PAP, CHAP, MSCHAP-V2, or None to determine an authentication protocol for the RADIUS server. These authentication protocols work as follows:
Enter a server priority to indicate the order in which RADIUS servers are accessed. Entering a one means that this server is checked first.
Click OK to add the RADIUS server to the EX Switching Access profile. You can add more RADIUS servers if needed.
If you have multiple RADIUS servers, you can prioritize them in the Authentication Server Order section, using the arrows.
Click Done to create the RADIUS server profile.
The RADIUS server name appears in the list of RADIUS servers on the Manage RADIUS Profiles page.
What to Do Next
Link the RADIUS server to an Access profile. For directions, see Creating and Managing Access Profiles.
Assigned settings from any profile, including this one, have lower priority than settings made directly to a controller or an access point. For more information, see Adding and Managing an Individual Access Point and Configuring a Controller .