Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

TechLibrary
Navigation

Using External AAA Authentication Services with DHCP

The extended DHCP local server, including DHCPv6 local server, and the extended DHCP relay agent, including DHCPv6 relay agent, support the use of external AAA authentication services, such as RADIUS, to authenticate DHCP clients. When the extended DHCP local server or relay agent receives a discover PDU from a client, the extended DHCP application contacts the AAA server to authenticate the DHCP client. The extended DHCP application can obtain client addresses and DHCP configuration options from the external AAA authentication server.

Note: This section uses the term extended DHCP application to refer to both the extended DHCP local server and the extended DHCP relay agent.

The external authentication feature also supports AAA directed logout. If the external AAA service supports a user logout directive, the extended DHCP application honors the logout and responds as though it were requested by a CLI management command. All of the client state information and allocated resources are deleted at logout. The extended DHCP application supports directed logout using the list of configured authentication servers you specify with the authentication-server statement at the [edit access profile profile-name] hierarchy level.

You can configure either global authentication support or group-specific support.

You must configure the username-include statement to enable the use of authentication. The password statement is not required and does not cause DHCP to use authentication if the username-include statement is not included.

To configure DHCP local server and DHCP relay agent authentication support:

  1. Specify that you want to configure authentication options.
    • For DHCP local server:
      [edit system services dhcp-local-server]user@host# edit authentication
    • For DHCP relay agent:
      [edit forwarding-options dhcp-relay]user@host# edit authentication
    • For DHCPv6 local server:
      [edit system services dhcp-local-server dhcpv6]user@host# edit authentication
    • For DHCPv6 relay agent:
      [edit forwarding-options dhcp-relay dhcpv6]user@host# edit authentication
  2. (Optional) Configure a password that authenticates the username to the external authentication service.

    See Configuring Passwords for Usernames.

  3. (Optional) Configure optional features to create a unique username.

    See Creating Unique Usernames for DHCP Clients.

 

Related Documentation

 

Published: 2013-04-01

Previous Page Next Page