Creating and Managing RADIUS Profiles

Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized authentication, authorization, and accounting (AAA) management for computers to connect and use a network service. By default, RADIUS servers are used for both accounting and authentication. From Network Director, you can create and manage RADIUS profiles that configure RADIUS server settings.

Tip:

In addition to your RADIUS server, you can configure an LDAP server for EX Series ELS switch authentication also—for directions, see Creating and Managing LDAP Profiles.

This topic describes:

Managing RADIUS Profiles

From the Manage RADIUS Profiles page, you can:

Create a new profile by clicking Add. For directions, see Creating RADIUS Profiles.
Modify an existing profile by selecting it and clicking Edit.
View information about a profile by selecting the group and clicking Details or by clicking the profile name.
Delete profiles by selecting the profile and clicking Delete.

Tip:
You cannot delete profiles that are in use—that is, assigned to objects or used by other profiles. To see the current assignments for a profile, select the profile and click Details.
Clone a profile by selecting the profile and clicking Clone.

Table 1 describes the information provided about RADIUS profiles on the Manage RADIUS Profiles page. This page lists all RADIUS profiles defined for your network, regardless of your current selected scope in the network view.

Table 1: RADIUS Profile Information
Field	Description
RADIUS Profile Name	Name given to the RADIUS profile when it was created.
Server Address	IP address of the RADIUS server.
Server Port	UDP port being used by the RADIUS server.
Creation Time	Date and time when this profile was created.
Update Time	Date and time when this profile was last modified.
User Name	The username of the user who created or modified the profile.

Tip:

All columns may not be currently displayed. To show or hide fields in the table, click the down arrow on the field header, select Columns, and select or clear the check box adjacent to the field that you want to show or hide.

Creating RADIUS Profiles

To create a RADIUS profile:

Click in the Network Director banner.
Under Select View, select either Logical View, Location View, Device View or Custom Group View.

Tip:
Do not select Dashboard View or Topology View.
From the Tasks pane, select the type of network (Wired), the appropriate functional area (System or AAA), and select the name of the profile that you want to create. For example, to create a port profile for a wired device, click Wired > Profiles > PORT. The Manage Profile page opens.
Click Add on the Manage RADIUS Profiles page.

The Create RADIUS Profile page appears.
Enter settings for the RADIUS profile on the Create RADIUS Profile page as described in Specifying Settings for a RADIUS Profile.
Click Done.

Specifying Settings for a RADIUS Profile

Use the Create RADIUS Profile page to define authentication, authorization, and accounting settings for a RADIUS server.

Table 2 describes the RADIUS profile settings.

Table 2: RADIUS Profile Settings
Field	Action
Server Name	Type a name for the server, using up to 64 alphanumeric characters and no special characters other than the underscore. The name must be unique among servers.
Server Address	Type the IP address of the RADIUS server.
Authentication Port (default is 1812)	Using the arrows, adjust the number of the UDP port to use for RADIUS authentication messages. The default UDP port is 1812, and the range is from 0 to 65535.
Secret	Provide a password for the RADIUS server.
Advanced Settings You can change the advanced settings for a RADIUS server, or you can use the default settings.
Accounting Port (default is 1813)	Using the arrows, adjust the number of the UDP port to use for RADIUS accounting messages. The default UDP port is 1813, and the range is from 0 to 65535.
Retry Count (default is 3)	Using the arrows, adjust the retry count until it reflects the number of times Network Director retries connecting to the RADIUS server when the RADIUS server is unavailable.
Timeout (default is 5 seconds)	Using the arrows, adjust the timeout value. Timeout indicates how many seconds Network Director allows for RADIUS server connection before giving an unreachable error.
Dead Time (default is 5 seconds)	Using the arrows, adjust the number of seconds before Network Director checks a RADIUS server that was previously unresponsive. The default value is 5 seconds.
Use MAC as Password	Enable this option if you want each client device to use its MAC address as its password for the RADIUS server. If you enable Use MAC As Password, then the Authorization Password field becomes unavailable.
Authorization Password	If you are not using MAC addresses as passwords for the RADIUS server, provide a common password here.
MAC Address Format	Select None, Hyphens, Colons, One-Hyphen, or Raw to determine the MAC address format used with the RADIUS server. For example: None—For unicast IPv4, an example MAC address is 0123456789ab. For unicast IPv6, an example MAC address is 20010db8000000000000ff0000428329. Hyphens—For unicast IPv4, an example MAC address using hyphens is 01-23-45-67-89-ab. For unicast IPv6, an example MAC address using hyphens is 2001-0db8-0000-0000-0000-ff00-0042-8329. Colons—For unicast IPv4, an example MAC address using colons is 01:23:45:67:89:ab. For unicast IPv6, an example MAC address using colons is 2001:0db8:0000:0000:0000:ff00:0042:8329. One-Hyphen: IPv6 unicast addresses other than those that start with binary 000 are logically divided into two parts: a 64-bit (sub-)network prefix, and a 64-bit interface identifier used to identify a host's network interface. The hyphen is placed between the two parts. Raw: The IPv6 address is represented by all numbers—no sections containing all zeros are skipped and then represented by a double colon. For example, this is a raw IPv6 address: 2001:0000:0234:C1AB:0000:00A0:AABC:003F.
Authentication Protocol (Default is PAP)	Select PAP, CHAP, MSCHAP-V2, or None to determine an authentication protocol for the RADIUS server. These authentication protocols work as follows: PAP: stands for Password Authentication Protocol and is used by Point to Point Protocols to validate users before allowing them access to server resources. Almost all network operating system remote servers support PAP. However, PAP transmits unencrypted ASCII passwords over the network and is therefore not secure. Use it as a last resort when the remote server does not support the stronger authentication. CHAP: stands for Challenge Handshake Authentication Protocol and authenticates a user or network host to an authenticating entity. CHAP provides protection against replay attacks by the peer through the use of an incrementally changing identifier and of a variable challenge-value. CHAP requires that both the client and server know the plaintext of the secret password—it is never sent over the network. CHAP provides better security than PAP does. MSCHAP-V2: stands for Microsoft’s implementation of the Challenge Handshake Authentication Protocol version 2 on the router for password-change support. This feature provides users accessing a router the option of changing the password when the password expires, is reset, or is configured to be changed at the next login. The MS-CHAP variant does not require either peer to know the plaintext of the secret password. MSCHAP-V2 is used as an authentication option with RADIUS servers used for Wi-Fi security using the WPA-Enterprise protocol.
Server Priority (default is 1)	Enter a server priority to indicate the order in which RADIUS servers are accessed. Entering a one means that this server is checked first.

Click OK to add the RADIUS server to the EX Switching Access profile. You can add more RADIUS servers if needed.

If you have multiple RADIUS servers, you can prioritize them in the Authentication Server Order section, using the arrows.

Click Done to create the RADIUS server profile.

The RADIUS server name appears in the list of RADIUS servers on the Manage RADIUS Profiles page.

What to Do Next

Link the RADIUS server to an Access profile. For directions, see Creating and Managing Access Profiles.