Configuring RADIUS Server Parameters for Subscriber Access

Include the radius statement at the [edit access profile profile-name] hierarchy level to specify the RADIUS parameters for the subscriber access manager feature. You can specify the IP addresses of the RADIUS servers used for authentication and accounting, options that provide configuration information for the RADIUS servers, and how RADIUS attributes are used.

• Specifying RADIUS Authentication and Accounting Servers for Subscriber Access
• Configuring RADIUS Server Options for Subscriber Access
• Configuring How RADIUS Attributes Are Used for Subscriber Access

Specifying RADIUS Authentication and Accounting Servers for Subscriber Access

You can specify one or more RADIUS authentication or accounting servers to use for subscriber access management.

To configure RADIUS authentication and accounting support:

1. Specify that you want to configure RADIUS support.

   [edit access profile isp-bos-metro-fiber-basic]

   user@host# edit radius

2. Specify the IP address of the RADIUS server used for authentication.

   [edit access profile isp-bos-metro-fiber-basic radius]

   user@host# set authentication-server 192.168.1.251

3. Specify the IP address of the RADIUS server used for accounting.

   [edit access profile isp-bos-metro-fiber-basic radius]

   user@host# set accounting-server 192.168.1.250

To configure multiple RADIUS authentication or accounting servers:

• Specify the IP addresses of all RADIUS servers used for authentication or accounting.

  [edit access profile isp-bos-metro-fiber-basic radius]

  user@host# set authentication-server 192.168.1.251 192.168.1.252

  user@host# set accounting-server 192.168.1.250 192.168.1.251

Configuring RADIUS Server Options for Subscriber Access

You can configure a variety of options used by the RADIUS authentication and accounting servers.

To configuradius-serverre RADIUS authentication and accounting server options:

1. Specify that you want to configure RADIUS.

   [edit access profile isp-bos-metro-fiber-basic]

   user@host# edit radius

2. Specify that you want to configure RADIUS options.

   [edit access profile isp-bos-metro-fiber-basic radius]

   user@host# edit options

3. (Optional) Configure the format the router uses to identify the accounting session. You can specify either decimal or description. The router uses decimal format by default.

   [edit access profile isp-bos-metro-fiber-basic radius options]

   user@host# set accounting-session-id-format decimal

4. (Optional) Configure the router to use a port type of virtual to authenticate clients. The port type is passed in RADIUS attribute 61 (NAS-Port-Type). By default, the router passes a port type of ethernet in RADIUS attribute 61.

   [edit access profile isp-bos-metro-fiber-basic radius options]

   user@host# set ethernet-port-type-virtual

5. (Optional) Specify the information that is included in or omitted from the interface description that the router passes to RADIUS for inclusion in RADIUS attribute 87 (NAS-Port-Id). By default, the router includes both the subinterface and the adapter in the interface description.

   [edit access profile isp-bos-metro-fiber-basic radius options]

   user@host# set interface-description-format adapter

6. (Optional) Configure the value for the client RADIUS attribute 32 (NAS-Identifier), which is used for authentication and accounting requests. You can specify a string in the range 1 to 64 characters.

   [edit access profile isp-bos-metro-fiber-basic radius options]

   user@host# set nas-identifier 56

7. (Optional) Configure the RADIUS client to use the extended format for RADIUS attribute 5 (NAS-Port) and specify one of the following options for the width of the fields in the NAS-Port attribute:
   • adapter-width width—Number of bits in the adapter field.
   • port-width width—Number of bits in the port field.
   • slot-width width—Number of bits in the slot field.
   • stacked-vlan-width width—Number of bits in the SVLAN ID field.
   • vlan-width width—Number of bits in the VLAN ID field.

   [edit access profile isp-bos-metro-fiber-basic radius options]

   user@host# set nas-port-extended-format 16

8. (Optional) Configure the number of seconds that the router waits after a server has become unreachable. The router rechecks the connection to the server when the revert-interval expires. If the server is then reachable, it is used in accordance with the order of the server list.

   [edit access profile isp-bos-metro-fiber-basic radius options]

   user@host# set revert-interval port-width 1200

9. (Optional) Specify that RADIUS attribute 5 (NAS-Port) includes the S-VLAN ID, in addition to the VLAN ID, for subscribers on Ethernet interfaces.

   [edit access profile isp-bos-metro-fiber-basic radius options]

   user@host# set vlan-nas-port-stacked-format

Configuring How RADIUS Attributes Are Used for Subscriber Access

You can specify the attributes RADIUS ignores in RADIUS Access-Accept messages, and the attributes RADIUS excludes from specified message types.

To configure the attributes RADIUS ignores or excludes:

1. Specify that you want to configure RADIUS.

   [edit access profile isp-bos-metro-fiber-basic]

   user@host# edit radius

2. Specify that you want to configure how RADIUS attributes are ignored or excluded.

   [edit access profile isp-bos-metro-fiber-basic radius]

   user@host# edit attributes

3. Specify the attributes you want RADIUS to ignore when the attributes are in Access-Accept messages. See Table 5 for the attributes you can configure.

   [edit access profile isp-bos-metro-fiber-basic radius attributes]

   user@host# set ignore input-filter output-filter

4. Configure RADIUS to exclude the specified attribute from the specified RADIUS message type. See Table 6 for the attributes and message type combinations you can configure.

   [edit access profile isp-bos-metro-fiber-basic radius attributes]

   user@host# set exclude input-filter output-filter

You use the ignore statement to configure the router to ignore a particular attribute in RADIUS Access-Accept messages. By default, the router processes the attributes received from the external AAA server. Table 5 lists the attributes supported in the ignore statement.

Table 5: Attributes That Can Be Ignored in RADIUS Accept-Accept Messages

You use the exclude statement to configure the router to exclude the specified attributes from the specified type of RADIUS message. Not all attributes appear in all types of RADIUS messages—the CLI indicates the RADIUS message type. By default, the router includes the specified attributes in RADIUS Access-Request, Acct-On, Acct-Off, Acct-Start, and Acct-Stop messages. Table 6 lists the attributes and message types supported in the exclude statement.

Table 6: Attributes That Can Be Excluded from RADIUS Messages