RADIUS

You can create, modify, and delete the RADIUS server template, authentication/accounting server, and authorization server. Before configuring a RADIUS authentication/ accounting server, you must create a RADIUS server template. A RADIUS server builds a unique database to store user names and passwords for authentication and accounting. The RADIUS authorization server receives authorization information sent by users and sends authorization information to users after users pass authorization.

Context

When a user logs in to a network device such as a switch or a network access server (NAS), the user name and password are sent to the network device. After the RADIUS client (an NAS server) on the network receives the user name and password, it sends an authentication request to the RADIUS server. If the request is valid, the RADIUS server completes authentication and sends the required authorization information to the RADIUS client. If the request is invalid, the RADIUS server sends the authorization failure information to the RADIUS client.

NOTE:

Most RADIUS configurations have default values. You can perform configurations according to networking requirements. You can modify the RADIUS configuration only when the RADIUS server template is not in use.

The RADIUS authorization server is mainly used to authorize users when users select services dynamically.

Procedure

Create a RADIUS server template.

Choose Security > AAA > RADIUS in the navigation tree to open the RADIUS page.

Click Create, and the Create RADIUS Template page is displayed.

Table 1 describes the parameters on the page.

**Table 1** Create a RADIUS Server Template
Parameter	Description
Template name	Indicates the name of a new RADIUS server template. This parameter is mandatory.
Key	When sending authentication packets, the switch and the RADIUS server encrypt important data such as the password to ensure the security of data transmission over the network. To ensure the validity of the authenticator and the authenticated end, the switch and the RADIUS server must be configured with the same key. The value is a string. By default, the shared key of a RADIUS server is huawei.
Confirm key	Indicates the confirmed shared key. The format is the same as that of the shared key.

Set parameters.
Click OK.

Modify a RADIUS server template.
1. Choose Security > AAA > RADIUS in the navigation tree to open the RADIUS page.
2. Click , and the Modify RADIUS Template page is displayed.
  NOTE:
  - Table 1 describes the parameters on the page.
  - The template name cannot be modified.
3. Set parameters.
4. Click OK.
Delete a RADIUS server template.
1. Choose Security > AAA > RADIUS in the navigation tree to open the RADIUS page.
2. Select a record that you want to delete and click Delete. The system asks you whether to delete the record.
  NOTE:
  - To select a record, click the check box of the record.
  - To delete records in batches, click the check boxes of the records.
3. Click OK.

Create a RADIUS authentication/accounting server.

Choose Security > AAA > RADIUS in the navigation tree to open the RADIUS page.

Click Create, and the Create RADIUS Authentication/Accounting Server page is displayed.

Table 2 describes the parameters on the page.

**Table 2** Create RADIUS Authentication/Accounting Server
Parameter	Description
Server type	Indicates the server type.
Template name	Indicates the RADIUS server template name. This parameter is mandatory.
IP address	Indicates the IP address of the server, for example, 10.10.10.1. This parameter is mandatory.
Port	Indicates the UDP port number of the server. This parameter is mandatory.
Weight	Indicates the weight of the server. The default value is 80.

Set parameters.
NOTE:
The device supports more than one servers. To add servers, click Add and set parameters.

When multiple servers are available, the device uses the server with the highest weight to perform authentication and accounting. If the servers have the same weights, the device uses the server configured first to perform authentication and accounting.
Click OK.

Modify a RADIUS authentication/accounting server.
1. Choose Security > AAA > RADIUS in the navigation tree to open the RADIUS page.
2. Click , and the Modify RADIUS Authentication/Accounting Server page is displayed.
  NOTE:
  Table 2 describes the parameters on the page.
3. Set parameters.
4. Click OK.
Delete a RADIUS authentication/accounting server.
1. Choose Security > AAA > RADIUS in the navigation tree to open the RADIUS page.
2. Select a record that you want to delete and click Delete. The system asks you whether to delete the record.
3. Click OK.

Create a RADIUS authorization server.

Choose Security > AAA > RADIUS in the navigation tree to open the RADIUS page.

Click Create, and the Create RADIUS Authorization Server page is displayed.

Table 3 describes the parameters on the page.

**Table 3** Create RADIUS Authorization Server
Parameter	Description
Server IP	Indicates the IP address of the authorization server, for example, 10.10.10.1. This parameter is mandatory.
RADIUS template	Indicates the RADIUS server template name. This parameter is optional.
Key	This parameter is mandatory. By default, no shared key is configured on a RADIUS authorization server.
ACK reserve interval	Indicates the duration in which an authorization acknowledgment packet is reserved. This parameter is optional.

Set parameters.
Click OK.

Modify a RADIUS authorization server.
1. Choose Security > AAA > RADIUS in the navigation tree to open the RADIUS page.
2. Click , and the Modify RADIUS Authorization Server page is displayed.
  NOTE:
  - Table 3 describes the parameters on the page.
  - The IP address of the authorization server cannot be changed.
3. Set parameters.
4. Click OK.
Delete a RADIUS authorization server.
1. Choose Security > AAA > RADIUS in the navigation tree to open the RADIUS page.
2. Select a record that you want to delete and click Delete. The system asks you whether to delete the record.
3. Click OK.