Dell MX9116n EMC SmartFabric OS10 User Guide - Page 952

radius-server host tls Configures a RADIUS server for RADIUS over TLS user authentication and secure communication. For RADIUS over TLS authentication, the radsec shared key and a security profile that uses an X.509v3 certificate are required. Syntax Parameters radius-server host {hostname | ip-address} tls security-profile profile-name [auth-port tcp-port-number] key {0 authentication-key | 9 authentication-key | authentication-key} • hostname - Enter the host name of the RADIUS server. • ip-address - Enter the IPv4 (A.B.C.D) or IPv6 (x:x:x:x::x) address of the RADIUS server. • tls - Enter tls to secure RADIUS server communication using the TLS protocol. • security-profile profile-name - Enter the name of an X.509v3 security profile to use with RADIUS over TLS authentication. To configure a security profile for an OS10 application, see Security profiles. • auth-port tcp-port-number - (Optional) Enter the TCP port number that the server uses for authentication. The range is from 0 to 65535. The default is 2083. • key 0 authentication-key - Enter the radsec shared key in plain text. • key 9 authentication-key - Enter the radsec shared key in encrypted format. • authentication-key - Enter the radsec shared key in plain text. It is not necessary to enter 0 before the key. Default TCP port 2083 on a RADIUS server for RADIUS over TLS communication Command Mode CONFIGURATION Usage Information For RADIUS over TLS authentication, configure the radsec shared key on the server and OS10 switch. The show running-configuration output displays both the unencrypted and encrypted key in encrypted format. Configure global settings for the timeout and retransmit attempts allowed on a RADIUS over TLS servers using the radius-server retransmit and radius-server timeout commands. RADIUS over TLS authentication requires that X.509v3 PKI certificates are configured on a certification authority and installed on the switch. For more information, including a complete RADIUS over TLS example, see X.509v3 certificates. Supported on the MX9116n and MX5108n switches in Full Switch mode starting in release 10.4.3.0. Also supported in SmartFabric mode starting in release 10.5.0.1. The no version of this command removes a RADIUS server from RADIUS over TLS communication. Example OS10(config)# radius-server host 1.5.6.4 tls security-profile radius-admin key radsec Supported Releases 10.4.3.0 or later radius-server retransmit Configures the number of authentication attempts allowed on RADIUS servers. Syntax radius-server retransmit retries Parameters retries - Enter the number of retry attempts, from 0 to 100. Default An OS10 switch retransmits a RADIUS authentication request three times. Command Mode CONFIGURATION Usage Information Use this command to globally configure the number of retransmit attempts allowed for authentication requests on RADIUS servers. Supported on the MX9116n and MX5108n switches in Full Switch mode starting in release 10.4.0E(R3S). Also supported in SmartFabric mode starting in release 10.5.0.1. The no version of this command resets the value to the default. 952 Security