Radius authentication

[Michoud]

I've been researching the differences between Radius and TACACS+ for user authentication/accounting on Cisco devices and I've come up with a few questions about Radius:

1) Can groups be used to define access levels?

2) What sort of access levels can be defined? Will I be restricted to allowing access to user EXEC and privileged EXEC only or can I define commands a specific user/group can use?

3) Anyone have any experience using Windows IAS service linked to Active Directory as an authentication system for Cisco devices? If so, please share your experience.


Thank you!

 

[drewdown]

Check it out here:

http://www.tek-tips.com/viewthread.cfm?qid=1125829&page=1

I used it at my last job, it worked without fail. Easy to setup in IAS as well. The only confusing part at first was the commands to get it enabled on the network device. The IAS part is easy.

 

[drewdown]

After reading that thread it may not be clear, here is a simple walkthrough that I did when I first setup RADIUS:

####################Configure Radius (have to have a encryption image loaded onto the switch to do so)
*Radius group is mods-radius (just to keep it the same across the board)
*Enter these commands below to setup the switch
*You also need to setup IAS on backup IAS

Step 1
config t

Step 2
radius-server host <radius server IP> key XXXXXXXX

Step 3
aaa new-model

Step 4
aaa group server radius mods-radius

Step 5
server <radius server IP>

step 6
aaa authentication login default local

Step 7
aaa authentiation login mods-radius group local

step 8
line vty 0 15

step 9
login authentication mods-radius
Copy run start

That will get Radius enabled on your switch. IAS is simple, create the client and add a policy allowing an AD group authentication. I didnt go as far as configuring enable passwords with raidus auth, I just used RADIUS to get into the switch and used the local enable password.

AS far as different levels of priviledges you can, just need to configure multiple access policies in IAS.

 

[Michoud]

When you say configure multiple access policies in IAS.


Does this allow me to create different groups? One group with user exec access and another group with privilege exec acccess?

 

[drewdown]

Yes that is what I meant.

 

[drewdown]

Check out this link my man, you assign priv. level in IAS:

http://www.xs4all.nl/~hermanb/cisco-ias.htm