Users Guide

Default TCP port 2083 on a RADIUS server for RADIUS over TLS communication
Command Mode CONFIGURATION
Usage
Information
For RADIUS over TLS authentication, configure the radsec shared key on the server and OS10 switch.
The show running-configuration output displays both the unencrypted and encrypted key in
encrypted format. Configure global settings for the timeout and retransmit attempts allowed on a
RADIUS over TLS servers using the radius-server retransmit and radius-server timeout
commands.
RADIUS over TLS authentication requires that X.509v3 PKI certificates are configured on a certification
authority and installed on the switch. For more information, including a complete RADIUS over TLS
example, see X.509v3 certificates.
Supported on the MX9116n and MX5108n switches in Full Switch mode starting in release 10.4.3.0. Also
supported in SmartFabric mode starting in release 10.5.0.1.
The no version of this command removes a RADIUS server from RADIUS over TLS communication.
Example
OS10(config)# radius-server host 1.5.6.4 tls security-profile radius-
admin key radsec
Supported
Releases
10.4.3.0 or later
radius-server nas-ip-address
Configures RADIUS attribute 4, NAS-IP-Address in the RADIUS request packet.
Syntax
radius-server nas-ip-address ipv4-address
Parameters ipv4-address—Enter an arbitrary IP address to be configured as the NAS IP address in A.B.C.D
format.
Defaults By default, the NAS IP attribute uses the management ethernet IP address. If management VRF is used
for RADIUS authentication, this attribute uses a static IP address, 127.100.100.2.
Command Mode CONFIGURATION
Usage
Information
Use this command when you use the management VRF for RADIUS authentication. This command
configures an arbitrary IP address to be used as RADIUS attribute 4, NAS-IP-Address without changing
the source IP address in the IP header of the RADIUS packets.
The no version of this command removes the configuration.
Example
OS10(config)# radius-server nas-ip-address 10.5.1.1
Supported
Releases
10.5.1.0 or later
radius-server retransmit
Configures the number of authentication attempts allowed on RADIUS servers.
Syntax
radius-server retransmit retries
Parameters retries — Enter the number of retry attempts, from 0 to 10.
Default An OS10 switch retransmits a RADIUS authentication request three times.
Command Mode CONFIGURATION
Usage
Information
Use this command to globally configure the number of retransmit attempts allowed for authentication
requests on RADIUS servers.
Supported on the MX9116n and MX5108n switches in Full Switch mode starting in release 10.4.0E(R3S).
Also supported in SmartFabric mode starting in release 10.5.0.1.
536 Layer 2