Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

RADIUS Authentication and Accounting Basic Configuration

 

Configuring Authentication and Accounting Parameters for Subscriber Access

You use an access profile to configure authentication and accounting support for the subscriber access management feature. The access profile enables you to specify the type of methods used for authentication and accounting. You can also configure how subscriber access management collects and uses accounting statistics.

To configure authentication and accounting for subscriber access:

  1. Specify the authentication and accounting methods to use.

    See Specifying the Authentication and Accounting Methods for Subscriber Access.

  2. Specify how accounting statistics are collected.

    See Configuring Per-Subscriber Session Accounting.

Specifying the Authentication and Accounting Methods for Subscriber Access

You can specify the authentication and accounting methods that subscriber access management uses.

You can configure multiple authentication and accounting methods—the authentication-order and accounting order statements specify the order in which the subscriber access management feature uses the methods. For example, an authentication entry of radius password specifies that RADIUS authentication is performed first; if it times out (for example, if the RADIUS server is unreachable), then local authentication (password) is attempted. However, if a method rejects the authentication attempt, no subsequent method is attempted. If password is configured as the first method to be attempted, authentication is always either accepted or rejected; in either case, no other method is attempted.

You can specify the following authentication methods with the authentication-order statement:

  • radius—RADIUS-based authentication using an external RADIUS server.

  • password—Local authentication using locally configured and stored usernames and passwords.

    Subscriber access management does not support the password option until Junos OS Release 18.2R1. Starting in Junos OS Release 18.2R1, you can use the password option to provide local authentication for individual subscribers, typically when you do not have external authentication and authorization servers, or when you want to use local authentication as a backup to external authentication. In this case, you configure the actual subscriber password with the password option of the subscriber username statement in the access profile. In earlier releases you must always specify the radius authentication method.

You can specify the following accounting methods:

  • radius—RADIUS-based accounting using an external RADIUS server.

To configure the authentication and accounting methods for subscriber access management:

  1. Specify the authentication methods and the order in which they are used.
  2. Specify the accounting method.

Specifying RADIUS Authentication and Accounting Servers for Subscriber Access

You can specify one or more RADIUS authentication or accounting servers to use for subscriber access management.

To configure RADIUS authentication and accounting support:

  1. Specify that you want to configure RADIUS support.
  2. Specify the IP address of the RADIUS server used for authentication.
  3. Specify the IP address of the RADIUS server used for accounting.

To configure multiple RADIUS authentication or accounting servers:

  • Specify the IP addresses of all RADIUS servers used for authentication or accounting.

Example: Configuring RADIUS-Based Subscriber Authentication and Accounting

Configuration

This example shows a RADIUS-based authentication and accounting configuration.

CLI Quick Configuration

Configuring Local Authentication and Authorization for Subscribers

Starting in Junos OS Release 18.2R1, you can configure local authentication and limited local authorization for subscribers. Local authentication supports all subscriber types that are currently supported by subscriber management and services on MX Series routers. Local authentication and authorization is useful in the following circumstances:

  • When you do not want to use external authentication and authorization servers.

  • When you want local authentication and authorization to provide a backup method in the event RADIUS authentication fails.

  • When you are migrating a network from E Series routers running JunosE software to MX Series routers running Junos OS.

Enable local authentication and authorization for subscribers by configuring the password option to be configured as an authentication-order method for the access profile. Then configure a password for each subscriber you want to authenticate locally. When a subscriber associated with the access profile logs in, the login username is compared to the configured username. If that matches, then the login password is compared to the configured password. Local authentication failures result from credential mismatches; that is, either the subscriber username or password do not match.

Local authentication can take the form of either of the following:

  • User password authentication—The configured password is used to verify the subscriber’s login password.

  • Challenge handshake authentication (CHAP)—The configured password acts as the challenge secret to verify the subscriber’s challenge password and challenge response credential.

You can also optionally configure several attributes, such as address pool, logical system, or routing instance, to be authorized locally for the subscriber when authentication is successful. If you do not configure an address or address pool for local authorization, address assignment is based on network matching or the first address pool assigned to the routing instance.

Note

Local authentication and authorization support a chassis-wide maximum of 100 subscribers. If subscribers are configured in access profiles where authentication-order password is not configured, local authentication does not occur, but these subscribers count against the system limit of 100 subscribers for local authentication.

To configure local authentication and authorization:

  1. Enable local authentication.

    If you want only local authentication to be used, then configure password as the only authentication method. If you want local authentication to back up RADIUS authentication in the event the method times out, then you must configure radius as the first method and password as the second method, like so:

    If you configure password as the first method, authentication is always either accepted or rejected. In either case, a second method is never attempted.

  2. Configure the local password for the subscriber.
  3. (Optional) Configure an IPv4 address for the subscriber.
  4. (Optional) Configure an address pool to assign an IPv4 address for the subscriber.
  5. (Optional) Configure an address pool to assign a router advertisement IPv6 prefix or a DHCPv6 IA_NA/128 address for the subscriber.
  6. (Optional) Configure an address pool to locally allocate a delegated IPv6 prefix.
  7. (Optional) Configure a logical system and if desired a routing instance assigned to the subscriber.
  8. (Optional) Configure a routing instance for the subscriber.

You can use the following show commands to display information about local authentication:

  • show network-access aaa statistics authentication detail—Displays failure statistics for local authentication.

  • show network-access requests statistics—Displays both local authentication and local reauthentication statistics such as requests received and the number of success and failure responses.

  • show network-access aaa statistics re-authentication—Displays reauthentication statistics, but they are aggregated from both local authentication and RADIUS.

Release History Table
Release
Description
Starting in Junos OS Release 18.2R1, you can configure local authentication and limited local authorization for subscribers.