Dell EMC SmartFabric OS10 User Guide Release 10.5.0

To configure a RADIUS server for authentication, enter the server IP address or hostname, and the key that is used to authenticate the OS10 switch on a RADIUS host. You can enter the authentication key in plain text or encrypted format. You can change the User Datagram Protocol (UDP) port number on the server.

• Configure a RADIUS authentication server in CONFIGURATION mode. By default, a RADIUS server uses UDP port 1812.

  radius-server host {hostname | ip-address}  key {0 authentication-key | 9 authentication-key | authentication-key} [auth-port port-number]

To configure more than one RADIUS server, re-enter the radius-server host command multiple times. If you configure multiple RADIUS servers, OS10 attempts to connect in the order you configured them. An OS10 switch connects with the configured RADIUS servers one at a time, until a RADIUS server responds with an accept or reject response. The switch tries to connect with a server for the configured number of retransmit retries and timeout period.

Configure global settings for the timeout and retransmit attempts that are allowed on RADIUS servers. By default, OS10 supports three RADIUS authentication attempts and times out after five seconds. No source interface is configured. The default VRF instance is used to contact RADIUS servers.

• Configure the number of times OS10 retransmits a RADIUS authentication request in CONFIGURATION mode, from 0 to 100 retries; the default is 3.

  radius-server retransmit retries

• Configure the timeout period used to wait for an authentication response from a RADIUS server in CONFIGURATION mode, from 0 to 1000 seconds; the default is 5.

  radius-server timeout seconds

• (Optional) Specify an interface whose IP address is used as the source IP address for user authentication with RADIUS servers in CONFIGURATION mode. By default, no source interface is configured. OS10 selects the source IP address of any interface from which a packet is sent to a RADIUS server.
  An interface may have two IPv4 addresses and multiple IPv6 addresses. The selected OS10 source interface matches the version of the RADIUS server IP address: IPv4 or IPv6.

  • For an IPv4 RADIUS server, the primary IPv4 address is used.
  • For an IPv6 server, any of the global IPv6 addresses that are configured on the interface are used.
  • If no address of the same IP version as the RADIUS server is configured, RADIUS authentication is performed with no source interface, using the IP address of the management interface. The management IP address serves as the RADIUS network access server (NAS) IP address on the switch.

  ip radius source-interface interface

  On the RADIUS server, you must update the configured IP routes using the Linux command line so that the source interface routes match the NAS IP route.

  If OS10 uses a RADIUS server VRF instance, a RADIUS server source interface is not supported and cannot be configured.

• (Optional) By default, the switch uses the default VRF instance to communicate with RADIUS servers. You can optionally configure a nondefault or the management VRF instance for RADIUS authentication in CONFIGURATION mode.

  radius-server vrf management
  radius-server vrf vrf-name

Configure RADIUS server

OS10(config)# radius-server host 1.2.4.5 key secret1
OS10(config)# radius-server retransmit 10
OS10(config)# radius-server timeout 10
OS10(config)# ip radius source-interface mgmt 1/1/1

Configure RADIUS server for non-default VRFs

OS10(config)# ip vrf blue
OS10(conf-vrf)# exit
OS10(config)# radius-server vrf blue

View RADIUS server configuration

OS10# show running-configuration
...
radius-server host 1.2.4.5 key 9 3a95c26b2a5b96a6b80036839f296babe03560f4b0b7220d6454b3e71bdfc59b
radius-server retransmit 10
radius-server timeout 10
ip radius source-interface mgmt 1/1/1
...

Delete RADIUS server

OS10# no radius-server host 1.2.4.5