Cisco WS-C2960S-24PD-L Software Guide - Page 194

Controlling Switch Access with RADIUS Chapter 6 Configuring the System Step 4 Step 5 Step 6 Step 7 Step 8 Command radius-server timeout seconds radius-server deadtime minutes end show running-config copy running-config startup-config Purpose Specify the number of seconds a switch waits for a reply to a RADIUS request before resending the request. The default is 5 seconds; the range is 1 to 1000. Specify the number of minutes a RADIUS server, which is not responding to authentication requests, to be skipped, thus avoiding the wait for the request to timeout before trying the next configured server. The default is 0; the range is 1 to 1440 minutes. Return to privileged EXEC mode. Verify your settings. (Optional) Save your entries in the configuration file. To return to the default setting for the retransmit, timeout, and deadtime, use the no forms of these commands. Configuring the Switch to Use Vendor-Specific RADIUS Attributes The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific information between the switch and the RADIUS server by using the vendor-specific attribute (attribute 26). Vendor-specific attributes (VSAs) allow vendors to support their own extended attributes not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific option by using the format recommended in the specification. Cisco's vendor-ID is 9, and the supported option has vendor-type 1, which is named cisco-avpair. The value is a string with this format: protocol : attribute sep value * Protocol is a value of the Cisco protocol attribute for a particular type of authorization. Attribute and value are an appropriate attribute-value (AV) pair defined in the Cisco TACACS+ specification, and sep is = for mandatory attributes and * for optional attributes. This allows the full set of features available for TACACS+ authorization to also be used for RADIUS. For example, the following AV pair activates Cisco's multiple named ip address pools feature during IP authorization (during PPP IPCP address assignment): cisco-avpair= "ip:addr-pool=first" The following example shows how to provide a user logging in from a switch with immediate access to privileged EXEC commands: cisco-avpair= "shell:priv-lvl=15" Other vendors have their own unique vendor-IDs, options, and associated VSAs. For more information about vendor-IDs and VSAs, refer to RFC 2138, "Remote Authentication Dial-In User Service (RADIUS)." 6-66 Catalyst 2900 Series XL and Catalyst 3500 Series XL Software Configuration Guide 78-6511-08