close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Working With Network Director
- play_arrow About Network Director
  - Understanding Network Director and the Management Life-Cycle Modes
  - Understanding the Network Director User Interface
- play_arrow Installing Network Director
  - Installing Network Director by Manually Downloading the Network Director Application Image
- play_arrow Accessing Network Director
- play_arrow Understanding Network Director System Administration and Preferences
- play_arrow Getting Started with Network Director
  - Getting Started with Junos Space Network Director
play_arrow Working with the Dashboard
- play_arrow About the Dashboard
  - Understanding the Dashboard
- play_arrow Using the Dashboard
  - Using Dashboard Widgets
- play_arrow Dashboard Widget Reference
play_arrow Working in Build Mode
- play_arrow About Build Mode
- play_arrow Discovering Devices
- play_arrow Setting Up Sites and Locations Using the Location View
- play_arrow Building a Topology View of the Network
- play_arrow Creating Custom Device Groups
  - Understanding Custom Device Groups
  - Creating Custom Device Groups
- play_arrow Configuring Quick Templates
  - Understanding Quick Templates
  - Configuring and Managing Quick Templates
- play_arrow Configuring Device Settings
- play_arrow Configuring Authentication, Authorization, and Access for Your Network
- play_arrow Configuring Interfaces and VLANs
- play_arrow Configuring Firewall Filters (ACLs)
  - Understanding Filter Profiles
  - Creating and Managing Wired Filter Profiles
- play_arrow Configuring Class of Service (CoS)
  - Understanding Class of Service (CoS) Profiles
  - Creating and Managing Wired CoS Profiles
- play_arrow Configuring Media Access Control Security (MACsec)
- play_arrow Configuring Link Aggregation Groups (LAGs)
- play_arrow Creating and Managing Fabrics
- play_arrow Configuring VRRP Profiles
  - Understanding VRRP Profiles
  - Creating and Managing VRRP Profiles
- play_arrow Managing Network Devices
play_arrow Working in Deploy Mode
- play_arrow About Deploy Mode
  - Understanding Deploy Mode in Network Director
  - Understanding the Deploy Mode Tasks Pane
- play_arrow Deploying and Managing Device Configurations
- play_arrow Deploying and Managing Software Images
- play_arrow Managing Devices
  - Enabling or Disabling Network Ports on Switches
  - Converting the QSFP+ Ports on QFX Series Devices
- play_arrow Setting Up Zero Touch Provisioning for Devices
  - Understanding Zero Touch Provisioning in Network Director
  - Configuring and Monitoring Zero Touch Provisioning
play_arrow Monitoring Devices and Traffic
- play_arrow About Monitor Mode
  - Understanding Monitor Mode in Network Director
  - Understanding the Monitor Mode Tasks Pane
- play_arrow Monitoring Traffic
- play_arrow Monitoring Client Sessions
- play_arrow Monitoring Devices
- play_arrow Monitoring and Analyzing Fabrics
  - Monitoring Junos Fusion Fabric Systems and Components
- play_arrow Monitoring Virtual Networks
  - Using Monitor Mode for Virtual Devices
  - Viewing vMotion History in Network Director
- play_arrow General Monitoring
- play_arrow Monitor Reference
play_arrow Using Fault Mode
- play_arrow About Fault Mode
  - Understanding Fault Mode in Network Director
  - Understanding the Fault Mode Tasks Pane
- play_arrow Using Fault Mode
- play_arrow Fault Reference
play_arrow Working in Report Mode
- play_arrow About Report Mode
- play_arrow Creating and Managing Reports
- play_arrow Report Reference
play_arrow Working with Network Director Mobile
- play_arrow About Network Director Mobile
  - Overview of Network Director Mobile
- play_arrow Getting Started with Network Director Mobile
- play_arrow Working in the Network Director Mobile Dashboard Mode
  - Monitoring Network-Wide Activity Using Network Director Mobile
  - Network Director Mobile Dashboard Reference
- play_arrow Working in the Network Director Mobile Devices Mode
  - Locating a Device and Viewing Device Properties Using Network Director Mobile
  - Monitoring Sessions on a Device Using Network Director Mobile

list Table of Contents

English

Creating and Managing RADIUS Profiles

Release: Network Director 7.1

date_range 23-May-23

arrow_backward

arrow_forward

Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized authentication, authorization, and accounting (AAA) management for computers to connect and use a network service. By default, RADIUS servers are used for both accounting and authentication. From Network Director, you can create and manage RADIUS profiles that configure RADIUS server settings.

Tip:

In addition to your RADIUS server, you can configure an LDAP server for EX Series ELS switch authentication also—for directions, see Creating and Managing LDAP Profiles.

This topic describes:

Managing RADIUS Profiles

From the Manage RADIUS Profiles page, you can:

Create a new profile by clicking Add. For directions, see Creating RADIUS Profiles.
Modify an existing profile by selecting it and clicking Edit.
View information about a profile by selecting the group and clicking Details or by clicking the profile name.
Delete profiles by selecting the profile and clicking Delete.

Tip:
You cannot delete profiles that are in use—that is, assigned to objects or used by other profiles. To see the current assignments for a profile, select the profile and click Details.
Clone a profile by selecting the profile and clicking Clone.

Table 1 describes the information provided about RADIUS profiles on the Manage RADIUS Profiles page. This page lists all RADIUS profiles defined for your network, regardless of your current selected scope in the network view.

Table 1: RADIUS Profile Information
Field	Description
RADIUS Profile Name	Name given to the RADIUS profile when it was created.
Server Address	IP address of the RADIUS server.
Server Port	UDP port being used by the RADIUS server.
Creation Time	Date and time when this profile was created.
Update Time	Date and time when this profile was last modified.
User Name	The username of the user who created or modified the profile.

Tip:

All columns may not be currently displayed. To show or hide fields in the table, click the down arrow on the field header, select Columns, and select or clear the check box adjacent to the field that you want to show or hide.

Creating RADIUS Profiles

To create a RADIUS profile:

Click in the Network Director banner.
Under Select View, select either Logical View, Location View, Device View or Custom Group View.

Tip:
Do not select Dashboard View or Topology View.
From the Tasks pane, select the type of network (Wired), the appropriate functional area (System or AAA), and select the name of the profile that you want to create. For example, to create a port profile for a wired device, click Wired > Profiles > PORT. The Manage Profile page opens.
Click Add on the Manage RADIUS Profiles page.

The Create RADIUS Profile page appears.
Enter settings for the RADIUS profile on the Create RADIUS Profile page as described in Specifying Settings for a RADIUS Profile.
Click Done.

Specifying Settings for a RADIUS Profile

Use the Create RADIUS Profile page to define authentication, authorization, and accounting settings for a RADIUS server.

Table 2 describes the RADIUS profile settings.

Table 2: RADIUS Profile Settings
Field	Action
Server Name	Type a name for the server, using up to 64 alphanumeric characters and no special characters other than the underscore. The name must be unique among servers.
Server Address	Type the IP address of the RADIUS server.
Authentication Port(default is 1812)	Using the arrows, adjust the number of the UDP port to use for RADIUS authentication messages. The default UDP port is 1812, and the range is from 0 to 65535.
Secret	Provide a password for the RADIUS server.
Advanced Settings You can change the advanced settings for a RADIUS server, or you can use the default settings.
Accounting Port(default is 1813)	Using the arrows, adjust the number of the UDP port to use for RADIUS accounting messages. The default UDP port is 1813, and the range is from 0 to 65535.
Retry Count(default is 3)	Using the arrows, adjust the retry count until it reflects the number of times Network Director retries connecting to the RADIUS server when the RADIUS server is unavailable.
Timeout (default is 5 seconds)	Using the arrows, adjust the timeout value. Timeout indicates how many seconds Network Director allows for RADIUS server connection before giving an unreachable error.
Dead Time(default is 5 seconds)	Using the arrows, adjust the number of seconds before Network Director checks a RADIUS server that was previously unresponsive. The default value is 5 seconds.
Use MAC as Password	Enable this option if you want each client device to use its MAC address as its password for the RADIUS server. If you enable Use MAC As Password, then the Authorization Password field becomes unavailable.
Authorization Password	If you are not using MAC addresses as passwords for the RADIUS server, provide a common password here.
MAC Address Format	Select None, Hyphens, Colons, One-Hyphen, or Raw to determine the MAC address format used with the RADIUS server. For example: None—For unicast IPv4, an example MAC address is 0123456789ab. For unicast IPv6, an example MAC address is 20010db8000000000000ff0000428329. Hyphens—For unicast IPv4, an example MAC address using hyphens is 01-23-45-67-89-ab. For unicast IPv6, an example MAC address using hyphens is 2001-0db8-0000-0000-0000-ff00-0042-8329. Colons—For unicast IPv4, an example MAC address using colons is 01:23:45:67:89:ab. For unicast IPv6, an example MAC address using colons is 2001:0db8:0000:0000:0000:ff00:0042:8329. One-Hyphen: IPv6 unicast addresses other than those that start with binary 000 are logically divided into two parts: a 64-bit (sub-)network prefix, and a 64-bit interface identifier used to identify a host's network interface. The hyphen is placed between the two parts. Raw: The IPv6 address is represented by all numbers—no sections containing all zeros are skipped and then represented by a double colon. For example, this is a raw IPv6 address: 2001:0000:0234:C1AB:0000:00A0:AABC:003F.
Authentication Protocol(Default is PAP)	Select PAP, CHAP, MSCHAP-V2, or None to determine an authentication protocol for the RADIUS server. These authentication protocols work as follows: PAP: stands for Password Authentication Protocol and is used by Point to Point Protocols to validate users before allowing them access to server resources. Almost all network operating system remote servers support PAP. However, PAP transmits unencrypted ASCII passwords over the network and is therefore not secure. Use it as a last resort when the remote server does not support the stronger authentication. CHAP: stands for Challenge Handshake Authentication Protocol and authenticates a user or network host to an authenticating entity. CHAP provides protection against replay attacks by the peer through the use of an incrementally changing identifier and of a variable challenge-value. CHAP requires that both the client and server know the plaintext of the secret password—it is never sent over the network. CHAP provides better security than PAP does. MSCHAP-V2: stands for Microsoft’s implementation of the Challenge Handshake Authentication Protocol version 2 on the router for password-change support. This feature provides users accessing a router the option of changing the password when the password expires, is reset, or is configured to be changed at the next login. The MS-CHAP variant does not require either peer to know the plaintext of the secret password. MSCHAP-V2 is used as an authentication option with RADIUS servers used for Wi-Fi security using the WPA-Enterprise protocol.
Server Priority(default is 1)	Enter a server priority to indicate the order in which RADIUS servers are accessed. Entering a one means that this server is checked first.

Click OK to add the RADIUS server to the EX Switching Access profile. You can add more RADIUS servers if needed.

If you have multiple RADIUS servers, you can prioritize them in the Authentication Server Order section, using the arrows.

Click Done to create the RADIUS server profile.

The RADIUS server name appears in the list of RADIUS servers on the Manage RADIUS Profiles page.

What to Do Next

Link the RADIUS server to an Access profile. For directions, see Creating and Managing Access Profiles.

arrow_backward PREVIOUS Understanding Central Network Access Using RADIUS and TACACS+

NEXT arrow_forward Creating and Managing LDAP Profiles

Network Director User Guide

ON THIS PAGE

Creating and Managing RADIUS Profiles

Managing RADIUS Profiles

Creating RADIUS Profiles

Specifying Settings for a RADIUS Profile

What to Do Next

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Network Director User Guide

ON THIS PAGE

Creating and Managing RADIUS Profiles

Managing RADIUS Profiles

Creating RADIUS Profiles

Specifying Settings for a RADIUS Profile

What to Do Next

Related Documentation

Stay in touch