RADIUS integration 1

[debcu]

Hello,
I'm using Cisco Router 1721. I would like to use RADIUS for client to access to my network. What should I do (from router point of view) to enable RADIUS authentification. IP of RADIUS server is 10.39.222.10. Please write full config for this service (step by step). Thanks a lot.

P.S.
When I try to enable RADIUS (my guide was e-book) nothing happen I mean:
when I try to use dialup connection (I put wrong user name and password), router allow me to enter to LAN (router should denied access).

 

[chipk]

From Global config, type:

aaa new-model
aaa authentication password-prompt Password:
aaa authentication username-prompt Username:
aaa authentication login default group radius local
aaa authentication login LOCAL local
aaa authentication ppp default group radius local
aaa authentication ppp users group radius
aaa authorization network users group radius
aaa accounting network default start-stop group radius

The above sets all RADIUS authen, author, acct options you should need. Below is how to create a local user on the router in the event that you can't contact the RADIUS server:

username exec privilege 15 password xxxxxxx

Below is the entry for specifying your actual RADIUS server.

radius-server host XXX.XXX.XXX.XXX auth-port 1645 acct-port 1646 non-standard timeout 10 key xxxxxxxxxxxxxxx

Key = a shared key that is set up on your RADIUS server. I'm familiar with Windows IAS, but not so much the UNIX side. What are you using for the RADIUS server?

 

[debcu]

Hello,
thanks for config but as I see you use on the first lines local authentification. I'm using RADIUS on remote ISA Server. I would like to enable RADIUS but authentification only from remote RADIUS server.
Could you wrote me new config?

 

[chipk]

The above config will do exactly that. The problem with your suggestion is that if your remote RADIUS server goes down, you cannot log in to your router at all.

The line that has local on it is in order of precedence, so for authentication, it checks RADIUS first, and then goes to LOCAL only if RADIUS fails. Unless you've got multiple RADIUS servers, I'd highly recommend having that local entry in there, along with the "username" command.

If you insist upon not having local enabled, then just go ahead and remove that word. That's the only change. However, I'd highly recommend configuring your console port for local in case you need to get in if your RADIUS server goes down, for example:

line con 0
session-timeout 60
password XXXXXXXXXXXXXXX
login authentication LOCAL

 

[ADB100]

Some stuff I replied to a while ago if it's of any use:

http://www.tek-tips.com/viewthread.cfm?qid=1125829

Andy