ON THIS PAGE
RADIUS Authentication and Accounting Basic Configuration
Configuring Authentication and Accounting Parameters for Subscriber Access
You use an access profile to configure authentication and accounting support for the subscriber access management feature. The access profile enables you to specify the type of methods used for authentication and accounting. You can also configure how subscriber access management collects and uses accounting statistics.
To configure authentication and accounting for subscriber access:
Specifying the Authentication and Accounting Methods for Subscriber Access
You can specify the authentication and accounting methods that subscriber access management uses.
You can configure multiple authentication and accounting methods—the authentication-order and accounting order statements
specify the order in which the subscriber access management feature
uses the methods. For example, an authentication entry of radius
password specifies that RADIUS authentication is performed first;
if it times out (for example, if the RADIUS server is unreachable),
then local authentication (password) is attempted. However,
if a method rejects the authentication attempt, no subsequent method
is attempted. If password is configured as the first method
to be attempted, authentication is always either accepted or rejected;
in either case, no other method is attempted.
You can specify the following authentication methods
with the authentication-order statement:
radius—RADIUS-based authentication using an external RADIUS server.password—Local authentication using locally configured and stored usernames and passwords.Subscriber access management does not support the
passwordoption until Junos OS Release 18.2R1. Starting in Junos OS Release 18.2R1, you can use thepasswordoption to provide local authentication for individual subscribers, typically when you do not have external authentication and authorization servers, or when you want to use local authentication as a backup to external authentication. In this case, you configure the actual subscriber password with thepasswordoption of thesubscriber usernamestatement in the access profile. In earlier releases you must always specify theradiusauthentication method.
You can specify the following accounting methods:
radius—RADIUS-based accounting using an external RADIUS server.
To configure the authentication and accounting methods for subscriber access management:
Specifying RADIUS Authentication and Accounting Servers for Subscriber Access
You can specify one or more RADIUS authentication or accounting servers to use for subscriber access management.
To configure RADIUS authentication and accounting support:
To configure multiple RADIUS authentication or accounting servers:
Specify the IP addresses of all RADIUS servers used for authentication or accounting.
[edit access profile isp-bos-metro-fiber-basic radius] user@host# set authentication-server 192.168.1.251 192.168.1.252 user@host# set accounting-server 192.168.1.250 192.168.1.251
Configuring Local Authentication and Authorization for Subscribers
Starting in Junos OS Release 18.2R1, you can configure local authentication and limited local authorization for subscribers. Local authentication supports all subscriber types that are currently supported by subscriber management and services on MX Series routers. Local authentication and authorization is useful in the following circumstances:
When you do not want to use external authentication and authorization servers.
When you want local authentication and authorization to provide a backup method in the event RADIUS authentication fails.
When you are migrating a network from E Series routers running JunosE software to MX Series routers running Junos OS.
Enable local authentication and authorization for subscribers
by configuring the password option to be configured as
an authentication-order method for the access profile.
Then configure a password for each subscriber you want to authenticate
locally. When a subscriber associated with the access profile logs
in, the login username is compared to the configured username. If
that matches, then the login password is compared to the configured
password. Local authentication failures result from credential mismatches;
that is, either the subscriber username or password do not match.
Local authentication can take the form of either of the following:
User password authentication—The configured password is used to verify the subscriber’s login password.
Challenge handshake authentication (CHAP)—The configured password acts as the challenge secret to verify the subscriber’s challenge password and challenge response credential.
You can also optionally configure several attributes, such as address pool, logical system, or routing instance, to be authorized locally for the subscriber when authentication is successful. If you do not configure an address or address pool for local authorization, address assignment is based on network matching or the first address pool assigned to the routing instance.
Local authentication and authorization support a chassis-wide
maximum of 100 subscribers. If subscribers are configured in access
profiles where authentication-order password is not configured,
local authentication does not occur, but these subscribers count against
the system limit of 100 subscribers for local authentication.
To configure local authentication and authorization:
You can use the following show commands to
display information about local authentication:
show network-access aaa statistics authentication detail—Displays failure statistics for local authentication.show network-access requests statistics—Displays both local authentication and local reauthentication statistics such as requests received and the number of success and failure responses.show network-access aaa statistics re-authentication—Displays reauthentication statistics, but they are aggregated from both local authentication and RADIUS.
Change History Table
Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.