RADIUS Authentication

This example configures system authentication through a RADIUS server.

Junos OS supports configuring Juniper Networks RADIUS and LDAP vendor-specific attributes (VSAs) on the authentication server. These VSAs are encapsulated in a RADIUS or LDAP vendor-specific attribute with the vendor ID set to the Juniper Networks ID number, 2636.

Table 1 lists the Juniper Networks VSAs that you can configure.

Some of the attributes accept extended regular expressions, as defined in POSIX 1003.2. If the regular expression contains any spaces, operators, or wildcard characters, enclose it in quotation marks. For more information, see:

• Regular Expressions to Allow and Deny Operational Mode Commands, Configuration Statements, and Hierarchies

• Use Regular Expressions on a RADIUS or TACACS+ Server to Allow or Deny Commands

For more information about the VSAs, see RFC 2138, Remote Authentication Dial In User Service (RADIUS).

Junos OS can map RADIUS- and TACACS+-authenticated users to a locally defined user account or user template account, which defines the user's access privileges. You can also optionally configure a user's access privileges by defining Juniper Networks RADIUS and TACACS+ vendor-specific attributes (VSAs) on the respective authentication server.

A user's login class defines the set of permissions that determines which operational mode and configuration mode commands a user is authorized to execute and which areas of the configuration a user can view and modify. A login class can also define regular expressions that allow or deny a user the ability to execute certain commands or view and modify certain areas of the configuration, in addition to what the permission flags authorize. A login class can include the following statements to define user authorization:

• permissions

• allow-commands

• allow-commands-regexps

• allow-configuration

• allow-configuration-regexps

• deny-commands

• deny-commands-regexps

• deny-configuration

• deny-configuration-regexps

Similarly, a RADIUS or TACACS+ server configuration can use Juniper Networks VSAs to define specific permissions or regular expressions that determine a user's access privileges. For the list of supported RADIUS and TACACS+ VSAs, see the following:

• Juniper Networks Vendor-Specific RADIUS and LDAP Attributes
• Juniper Networks Vendor-Specific TACACS+ Attributes

You can define user permissions on the RADIUS or TACACS+ server as a list of space-separated values.

• A RADIUS server uses the following attribute and syntax:

  For example:

• A TACACS+ server uses the following attribute and syntax:

  For example:

A RADIUS or TACACS+ server can also define Juniper Networks VSAs that use a single extended regular expression (as defined in POSIX 1003.2) to allow or deny a user the ability to execute certain commands or view and modify areas of the configuration. You enclose multiple commands or configuration hierarchies in parentheses and separate them using a pipe symbol. If the regular expression contains any spaces, operators, or wildcard characters, enclose it in quotation marks. When you configure authorization parameters both locally and remotely, the device merges the regular expressions received during TACACS+ or RADIUS authorization with any regular expressions defined on the local device.

• A RADIUS server uses the following attributes and syntax:

  For example:

• A TACACS+ server uses the following attributes and syntax:

  For example:

RADIUS and TACACS+ servers also support configuring attributes that correspond to the same *-regexps statements that you can configure on the local device. The *-regexps TACACS+ attributes and the *-Regexps RADIUS attributes use the same regular expression syntax as the previous attributes, but they enable you to configure regular expressions with variables.

• A RADIUS server uses the following attributes and syntax:

• A TACACS+ server uses the following attributes and syntax:

  For example, the TACACS+ server configuration might define the following attributes:

On a RADIUS or TACACS+ server, you can also define the attributes using a simplified syntax where you specify each individual expression on a separate line.

For a RADIUS server, specify the individual regular expressions using the following syntax:

For a TACACS+ server, specify the individual regular expressions using the following syntax:

Users can verify their class, permissions, and command and configuration authorization by issuing the show cli authorization operational mode command.

Devices support the configuration of RADIUS server attributes specific to Juniper Networks. These attributes are known as vendor-specific attributes (VSAs) and are described in RFC 2138, Remote Authentication Dial In User Service (RADIUS).

Through VSAs, you can configure port-filtering attributes on the RADIUS server. VSAs are cleartext fields sent from the RADIUS server to the device as a result of authentication success or failure. Authentication prevents unauthorized user access by blocking a supplicant at the port until the device is authenticated by the RADIUS server. The VSA attributes are interpreted by the device during authentication, and the device takes appropriate actions. Implementing port-filtering attributes with authentication on the RADIUS server provides a central location for controlling LAN access for supplicants.

These port-filtering attributes specific to Juniper Networks are encapsulated in a RADIUS-server VSA with the vendor ID set to the Juniper Networks ID number, 2636.

As well as configuring port-filtering attributes through VSAs, you can apply a previously configured port firewall filter directly to the RADIUS server. Like port-filtering attributes, the filter is applied during the authentication process, and its actions are applied at the device port. Adding a port firewall filter to a RADIUS server eliminates the need to add the filter to multiple ports and devices.

The Juniper-Switching-Filter VSA works in conjunction with 802.1X authentication to centrally control access of supplicants to the network. You can use this VSA to configure filters on the RADIUS server. These filters are sent to the switch and applied to users that have been authenticated using 802.1X authentication.

The Juniper-Switching-Filter VSA can contain one or more filter terms. Filter terms are configured using one or more match conditions with a resulting action. Match conditions are the criteria that a packet must meet for a configured action to be applied on it. The configured action is the action that the switch takes if a packet meets the criteria specified in the match conditions. The action that the switch can take is to either accept or deny a packet.

The following guidelines apply when you specify match conditions and actions for VSAs:

• Both the match statement and the action statement are mandatory.

• If no match condition is specified, any packet is considered a match by default.

• If no action is specified, the default action is to deny the packet.

• Any or all options can be included in each match and action statement.

• The AND operation is performed on fields that are of a different type, separated by commas. Fields of the same type cannot be repeated.

• For the forwarding-class option to be applied, the forwarding class must be configured on the switch. If the forwarding class is not configured on the switch, this option is ignored.

Table 2 describes the match conditions that you can specify when you configure a VSA attribute as a firewall filter by using the match command on the RADIUS server. The string that defines a match condition is called a match statement.

When you define one or more terms that specify the filtering criteria, you also define the action to take if the packet matches all criteria. Table 3 shows the actions that you can specify in a term.

The RADIUS accounting process between the device and a RADIUS server works like this:

1. A RADIUS accounting server listens for User Datagram Protocol (UDP) packets on a specific port. The default port for RADIUS accounting is 1813.

2. The device forwards an Accounting-Request packet containing an event record to the accounting server. The event record associated with this supplicant contains an Acct-Status-Type attribute whose value indicates the beginning of user service for this supplicant. When the supplicant’s session ends, the accounting request contains an Acct-Status-Type attribute value indicating the end of user service. The RADIUS accounting server records this as a stop-accounting record containing session information and the length of the session.

3. The RADIUS accounting server logs these events in a file as start-accounting or stop-accounting records. On FreeRADIUS, the filename is the server’s address, such as 192.0.2.0.

4. The accounting server sends an Accounting-Response packet to the device confirming that it has received the accounting request.

5. If the device does not receive an Accounting-Response packet from the server, it continues to send accounting requests until the server returns a response.

You can view the statistics collected through this process on the RADIUS server. To see those statistics, access the log file configured to receive them.