2.5.2 - Force10 Networks

Command Syntax Command Mode Purpose
priority priority TACACS
Configuration
timeout TACACS
Configuration
To delete a TACACS+ server host, use the no tacacs-server host ip-address command.
Configuring a RADIUS Connection
Determine the order in which the server will be used with multiple
authentication servers, with 0 being the highest priority.
Range: zero (0) to 65535. Default = 0
Range: 1 to 30 seconds. Default = global setting
Remote Authentication Dial-In User Service (RADIUS) is another means of port-based network access
control. The switch acts as an intermediary to a RADIUS server, which provides both an authentication
and an accounting function to maintain data on service usages.
Under RFC 2866, an extension was added to the RADIUS protocol giving the client the ability to deliver
accounting information about a user to an accounting server. Exchanges to the accounting server follow
similar guidelines to that of an authentication server, but the flows are much simpler.
At the start of service for a user, the RADIUS client configured to use accounting sends an accounting start
packet specifying the type of service that it will deliver. Once the server responds with an
acknowledgement, the client periodically transmits accounting data. At the end of service delivery, the
client sends an accounting stop packet allowing the server to update specified statistics. The server again
responds with an acknowledgement.
Setting up a connection to a server running Remote Authentication Dial-In User Service (RADIUS) is
basically the same as the TACACS+ procedure described above (see Choosing a TACACS+ Server and
Authentication Method on page 143 and Configuring TACACS+ Server Connection Options on page 145),
where you identify the address of the authentication server and you specify an ordered set of authentication
methods. The following RADIUS commands are documented in the Security chapter of the SFTOS
Command Reference:
• radius accounting mode: Enable the RADIUS accounting function.
• radius server host: Configure the RADIUS authentication and accounting server.
• radius server key: Configure the shared secret between the RADIUS client and the RADIUS
accounting / authentication server.
• radius server msgauth: Enable the message authenticator attribute for a specified server.
• radius server primary: Configure the primary RADIUS authentication server for this RADIUS
client.
• radius server retransmit: Set the maximum number of times a request packet is re-transmitted
when no response is received from the RADIUS server.
• radius server timeout: Set the timeout value (in seconds) after which a request must be
retransmitted to the RADIUS server if no response is received.
146 Providing User Access Security