Creating and Managing RADIUS Profiles
Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized authentication, authorization, and accounting (AAA) management for computers to connect and use a network service. By default, RADIUS servers are used for both accounting and authentication. From Network Director, you can create and manage RADIUS profiles that configure RADIUS server settings.
 | Tip: In addition to your RADIUS server, you can configure an LDAP server for either wireless and EX Series ELS switch authentication—for directions, see Creating and Managing LDAP Profiles. |
This topic describes:
Managing RADIUS Profiles
From the Manage RADIUS Profiles page, you can:
- Create a new profile by clicking Add. For directions, see Creating RADIUS Profiles.
- Modify an existing profile by selecting it and clicking Edit.
- View information about a profile by selecting the group and clicking Details or by clicking the profile name.
- Delete profiles by selecting the profile and clicking Delete.
Tip: You cannot delete profiles that are in use—that is, assigned to objects or used by other profiles. To see the current assignments for a profile, select the profile and click Details.
- Clone a profile by selecting the profile and clicking Clone.
Table 1 describes the information provided about RADIUS profiles on the Manage RADIUS Profiles page. This page lists all RADIUS profiles defined for your network, regardless of your current selected scope in the network view.
Table 1: RADIUS Profile Information
Field | Description |
|---|---|
RADIUS Profile Name | Name given to the RADIUS profile when it was created. |
Server Address | IP address of the RADIUS server. |
Server Port | UDP port being used by the RADIUS server. |
Creation Time | Date and time when this profile was created. |
Update Time | Date and time when this profile was last modified. |
User Name | The username of the user who created or modified the profile. |
| Tip: All columns may not be currently displayed. To show or hide fields in the table, click the down arrow on the field header, select Columns, and select or clear the check box adjacent to the field that you want to show or hide. |
Creating RADIUS Profiles
To create a RADIUS profile:
- Click
in the
Network Director banner. - Under Select View, select either Logical View, Location View, Device View or Custom
Group View.
Tip: Do not select Virtual View or Topology View.
- Click RADIUS under Profile and Configuration
Management in the Tasks pane.
The Manage RADIUS Profiles page appears.
- Click Add on the Manage RADIUS Profiles page.
The Create RADIUS Profile page appears.
- Enter settings for the RADIUS profile on the Create RADIUS Profile page as described in Specifying Settings for a RADIUS profile.
- Click Done.
Specifying Settings for a RADIUS profile
Use the Create RADIUS Profile page to define authentication, authorization, and accounting settings for a RADIUS server.
Table 2 describes the RADIUS Profile settings.
Table 2: RADIUS Profile Settings
Field | Action |
|---|---|
Server Name | Type a name for the server, using up to 64 alphanumeric characters and no special characters other than an underscore. The name must be unique among servers. |
Server Address | Type the IP address of the RADIUS server. |
Authentication Port | Using the arrows, adjust the number of the UDP port to use for RADIUS authentication messages. The default UDP port is 1812, and the range is from 0 to 65535. |
Secret | Provide a password for the RADIUS server. |
| Advanced Settings You can change the advanced settings for a RADIUS server, or you can use the default settings. | |
Accounting Port | Using the arrows, adjust the number of the UDP port to use for RADIUS accounting messages. The default UDP port is 1813, and the range is from 0 to 65535. |
Retry Count | Using the arrows, adjust the retry count until it reflects the number of times Network Director retries connecting to the RADIUS server when the RADIUS server is unavailable. |
Timeout | Using the arrows, adjust the timeout value. Timeout indicates how many seconds Network Director allows for RADIUS server connection before giving an unreachable error. |
Revert Interval | Specify the number of seconds the switch waits after an authentication server becomes unreachable. The switch rechecks the connection to the server when the specified interval expires. Default is 3 seconds. |
Dead Time | Using the arrows, adjust the number of seconds before Network Director checks a RADIUS server that was previously unresponsive. The default value is 5 seconds. |
Use MAC as Password | Enable this option if you want each client device to use its MAC address as its password for the RADIUS server. If you enable Use MAC As Password, then the Authorization Password field becomes unavailable. |
Authorization Password | If you are not using MAC addresses as passwords for the RADIUS server, provide a common password here. |
MAC Address Format | Select <gui>None</gui>, <gui>Hyphens</gui>, <gui>Colons</gui >, <gui>One-Hyphen</gui>, or <gui>Raw</gui> to determine the MAC address format used with the RADIUS server. For example:
|
Authentication Protocol | Select PAP, CHAP, MSCHAP-V2, or None to determine an authentication protocol for the RADIUS server. These authentication protocols work as follows:
|
Server Priority | Enter a server priority to indicate the order in which RADIUS servers are accessed. Entering a one means that this server is checked first. |
Click OK to add the RADIUS server to the EX Switching Access profile. You can add more RADIUS servers if needed.
If you have multiple RADIUS servers, you can prioritize them in the Authentication Server Order section, using the arrows.
Click Done to create the RADIUS server profile.
The RADIUS server name appears in the list of RADIUS servers on the Manage RADIUS Profiles page.
What to Do Next
Link the RADIUS server to an Access profile. For directions, see Creating and Managing Access Profiles.
