RADIUS

Cisco Equipment

Cisco equipment runs the IOS software and, while it’s become a common piece of equipment to find in an ISP, it does have some quirks of its own. Let’s take a look at a few.

If you are running IOS Version 12 (either the .0 or .1 releases), then set the following configuration commands:

    aaa new-model
    aaa authentication login default group radius local
    aaa authentication login localauth local
    aaa authentication ppp default if-needed group radius local
    aaa authorization exec default group radius local
    aaa authorization network default group radius local
    aaa accounting delay-start
    aaa accounting exec default start-stop group radius
    aaa accounting network default start-stop group radius
    aaa processes 6

If you are running IOS Version 11.1, then set the following configuration commands:

    aaa new-model
    aaa authentication ppp radppp if-needed radius
    aaa authorization network radius none
    aaa accounting network wait-start radius
    aaa accounting network wait radius
    radius-server timeout 3

This instructs the NAS to communicate with a RADIUS server and eliminates a lot of duplicate log entries. If you run IOS Version 11.3, then add the following command to the previous list:

aaa accounting update newinfo

This allows the IP address assigned to the user to be displayed upon running the radwho program (discussed earlier in the chapter). By default, the default Accounting Start packet sent from the NAS doesn’t include the new client’s IP address. This command tells IOS to send another packet ...