RADIUS Configuration Example

The following example configures four RADIUS hosts. 

device(config)# radius-server host 10.10.10.103 auth-port 1812 acct-port 1813 default key mykeyword dot1x port-only
device(config)# radius-server host 10.10.10.104 auth-port 1812 acct-port 1813 default key mykeyword dot1x port-only
device(config)# radius-server host 10.10.10.105 auth-port 1812 acct-port 1813 default key mykeyword dot1x
device(config)# radius-server host 10.10.10.106 auth-port 1812 acct-port 1813 default key mykeyword dot1x
device(config)# radius-server host 10.10.10.106 auth-port 1812 acct-port 1813 default key mykeyword mac-auth
device(config)# radius-server host 10.10.10.106 auth-port 1812 acct-port 1813 default key mykeyword web-auth

The configuration has the following effect:

  • RADIUS servers 10.10.10.103 and 10.10.10.104 are configured with the port-only option so that they authenticate users only on ports to which the servers are mapped. To map a RADIUS server to a port, refer to Mapping RADIUS Servers to Ports.
  • RADIUS servers 10.10.10.105 and 10.10.10.106 are used to authenticate users on ports to which no RADIUS servers are mapped. For example, port e 9, to which no RADIUS servers are mapped, sends a RADIUS request to the first configured RADIUS server, 10.10.10.105. If the request fails, it goes to the second configured RADIUS server, 10.10.10.106. The request never goes to server 10.10.10.103 or 10.10.10.104 because these servers are configured as port servers.

The following example configures two non-port-aligned RADIUS servers with different priority settings. RADIUS server 10.10.10.105 is configured as priority 7, the highest priority. It will be selected for 802.1x authentication first, regardless of the order in which it was configured. RADIUS server 10.10.10.106 is configured as priority 6 and will be selected if the priority 7 server is not available.

device(config)# radius-server host 10.10.10.105 auth-port 1812 acct-port 1813 default key mykeyword dot1x priority 7
device(config)# radius-server host 10.10.10.106 auth-port 1812 acct-port 1813 default key mykeyword dot1x priority 6
Parent topic: RADIUS Authentication