Cisco WS-C2955T-12 User Manual

6-66
Catalyst 2900 Series XL and Catalyst 3500 SeriesXL Software Configuration Guide
78-6511-08
Chapter 6 Configuring the System
Controlling Switch Access with RADIUS
To return to the default setting for the retransmit, timeout, and deadtime, use the no forms of these
commands.
Configuring the Switch to Use Vendor-Specific RADIUS Attributes
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating
vendor-specific information between the switch and the RADIUS server by using the vendor-specific
attribute (attribute 26). Vendor-specific attributes (VSAs) allow vendors to support their own extended
attributes not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific
option by using the format recommended in the specification. Cisco’s vendor-ID is 9, and the supported
option has vendor-type 1, which is named cisco-avpair. The value is a string with this format:
protocol : attribute sep value *
Protocol is a value of the Cisco protocol attribute for a particular type of authorization. Attribute and
value are an appropriate attribute-value (AV) pair defined in the Cisco TACACS+ specification, and sep
is = for mandatory attributes and * for optional attributes. This allows the full set of features available
for TACACS+ authorization to also be used for RADIUS.
For example, the following AV pair activates Cisco’s multiple named ip address pools feature during IP
authorization (during PPP IPCP address assignment):
cisco-avpair= ”ip:addr-pool=first“
The following example shows how to provide a user logging in from a switch with immediate access to
privileged EXEC commands:
cisco-avpair= ”shell:priv-lvl=15“
Other vendors have their own unique vendor-IDs, options, and associated VSAs. For more information
about vendor-IDs and VSAs, refer to RFC 2138, “Remote Authentication Dial-In User Service
(RADIUS).”
Step 4
radius-server timeout seconds Specify the number of seconds a switch waits for a reply to a RADIUS
request before resending the request. The default is 5 seconds; the range is
1 to 1000.
Step 5
radius-server deadtime minutes Specify the number of minutes a RADIUS server, which is not responding
to authentication requests, to be skipped, thus avoiding the wait for the
request to timeout before trying the next configured server. The default is
0; the range is 1 to 1440 minutes.
Step 6
end Return to privileged EXEC mode.
Step 7
show running-config Verify your settings.
Step 8
copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose

Cisco WS-C2955T-12 Specifications

General

Brand	Cisco
Model	WS-C2955T-12
Category	Switch
Language	English