Radius Authentication

[dozier]

Ok, I've got the basic authentication working through radius, but now I want it to assign certain privilege levels based on the username. It seems to me this would be done through authorization, but I can't seem to get it to work. Can anyone point me in the right direction? I've purchased the RADIUS book, and I have access to many Cisco books online, and I can't seem to find what I'm looking for. Thanks.

 

[bf0x]

See if this will answer your questions.

http://www.cisco.com/warp/public/480/PRIV.html

 

[dozier]

Thanks for the link. It doesn't really shed any light for me on how it's done, though. In fact, that document confused me. I'll keep searching.

 

[dozier]

I've got it working now.

Cisco config:

aaa authentication login radius-auth group radius
aaa authorization exec radius-auth group radius
!
!
!
line vty 0 4
 authorization exec radius-auth
 login authentication radius-auth

freeRADIUS config (users file):

testaccount     Auth-Type := System
                Cisco-AVPair = "shell:priv-lvl=15"

 

[bf0x]

dozier,

Sounds great. Good job.