Configuring RADIUS authentication using the CLI

This section describes how to configure a RADIUS server to return Local-User attributes, and to enable an appliance to authenticate with a RADIUS server.

Configuring a RADIUS server

Note

Your RADIUS server configuration should follow standard RADIUS protocol. The examples in this section are provided for illustration only.

To configure a RADIUS server:

Configure a secret key on the authentication server. The same key must be configured on both the server and the appliance.
Create a dictionary to reference the following mapping data:
```
VENDOR FireEye 25597
BEGIN-VENDOR FireEye
ATTRIBUTE FireEye-Local-User 1 string
END-VENDOR FireEye
```
where Local-User is the mapping attribute with an index of 1 that matches the FireEye code.
Store the dictionary, typically in the /user/share/radius/dictionary directory.
Use the authentication types shown in the following example to create user authentications against the RADIUS server login credentials, and authentication against “on-the-fly” passwords:
```
<username> Auth-Type := System
               FireEye-Local-User = “admin” 
r-admin    Auth-Type := Local, User-Password == “test123”
               FireEye-Local-User = “admin” 
r-monitor  Auth-Type := Local, User-Password == “test123”
               FireEye-Local-User = “monitor”
```
Both r-admin and r-monitor are authenticated against “on-the-fly” passwords. Local-User is the string defined in the dictionary and used by the authentication server to map to the local user. In the example above, both <username> and r-admin are Admin users on the Trellix appliance, while r-monitor is mapped to the appliance’s Monitor role.
Restart the RADIUS server after authentication mappings are modified. For example, enter service radiusd restart.

Important

Auth-Type := System causes the RADIUS server to use the password file on the server for user passwords. Passwords for users with the Admin or Monitor role must be specified on an individual basis.

Enabling an appliance to authenticate with a RADIUS server

Use the commands in this section to enable an appliance to authenticate with a RADIUS server.

Important

You can configure multiple RADIUS servers on an appliance. The appliance will contact the servers in the order in which they were configured. If the first server in the list is unreachable, the appliance will contact the next server, and so on.

Note

You can configure some RADIUS settings globally, so the settings apply to all new RADIUS servers configured on an appliance and become the new default settings. For example, you could use the radius-server timeout <seconds> command to configure the timeout value for all RADIUS servers.

To enable RADIUS authentication:

Define the server host and server key attributes:
```
hostname <config> # radius-server host <ip address> key <key string>
```
where ip address is the IPv4 or IPv6 address of the RADIUS server and key string is the secret key configured on the RADIUS server.
Note
Link-local and site-local IPv6 addresses are not supported.
By default, the appliance retransmits a request that previously timed out after three seconds. To change the number of seconds:
```
hostname (config) # radius-server host <ip address> timeout <seconds>
```
where seconds can be 1–60.
By default, the appliance attempts to contact the RADIUS server one time before the request fails. To change the number of attempts:
```
hostname (config) # radius-server host <ip address> retransmit <number>
```
where number can be 0–5.
By default, the port number for RADIUS authentication is 1812. To change the port number, or to define an additional port for another RADIUS service:
```
hostname (config) # radius-server host <ip address> auth-port <port number>
```
Add RADIUS authentication to the authentication method list in the desired order. For example:
```
hostname (config) # aaa authentication login default local radius
```
Verify your changes:
```
hostname (config) # show radius
```

Note

A RADIUS server is administratively enabled by default. Use the radius-server host <ip address> enable command if you need to re-enable it, or if you want to add a new RADIUS server that is initially disabled.

See the CLI Command Reference for a complete list of RADIUS server commands and parameters.

Examples

The following example configures a RADIUS server and changes the timeout and retransmit values.

hostname (config) # radius-server host 192.168.1.1 key 12345678
hostname (config) # radius-server host 192.168.1.1 timeout 5
hostname (config) # radius-server host 192.168.1.1 retransmit 2
hostname (config) # aaa authentication login default local radius
hostname (config) # show radius
RADIUS Settings:
    Authentication and Authorization are enabled in AAA configuration.

RADIUS DEFAULTS:
    Key:               ********
    Timeout:           3
    Retransmit:        1
RADIUS servers:
   192.168.1.1:1812
      Enabled:          yes
      Key:              *********
      Timeout:          5
      Retransmit:       2

The following example configures three RADIUS servers on the appliance, and then defines global settings for the timeout and retransmit values.

hostname (config) # radius-server host 192.168.1.2 key 12345678
hostname (config) # radius-server host fdd3:c75:345::8a4 key 34567890
hostname (config) # radius-server host 192.168.3.4 key 98765432
hostname (config) # aaa authentication login default local radius
hostname (config) # radius-server timeout 5
hostname (config) # radius-server retransmit 1
hostname (config) # show radius
RADIUS Settings:
    Authentication and Authorization are enabled in AAA configuration.

RADIUS defaults:
    Key:               ********
    Timeout:           5
    Retransmit:        1
RADIUS servers:
    192.168.1.2:1812
       Enabled:        yes
       Key:            ********
       Timeout:        5 (default)
       Retransmit:     1 (default)
    fdd3:c75:345::8a4:1812
       Enabled:        yes
       Key:            ********
       Timeout:        5 (default)
       Retransmit:     1 (default)
    192.168.3.4:1812
       Enabled:        yes
       Key:            ********
       Timeout:        5 (default)
       Retransmit:     1 (default)