aaa

system aaa: SDE M10-Smart M2 RS420 AresC640
AAA subsystem

system aaa authorization: SDE M10-Smart M2 RS420 AresC640
Authorization parameters

system aaa authorization privilege-map: SDE M10-Smart M2 RS420 AresC640
Privilege level to role mapping

system aaa authorization privilege-map radius: SDE M10-Smart M2 RS420 AresC640
RADIUS privilege level

system aaa authorization privilege-map radius privileged: SDE M10-Smart M2 RS420 AresC640
RADIUS privileged user privilege level

system aaa authorization privilege-map radius privileged role <id>

SDE M10-Smart M2 RS420 AresC640

Values:

id – Mapped role

system aaa authorization privilege-map radius standard: SDE M10-Smart M2 RS420 AresC640
RADIUS standard user privilege level

system aaa authorization privilege-map radius standard role <id>

SDE M10-Smart M2 RS420 AresC640

Values:

id – Mapped role

system aaa authorization privilege-map tacacs <u32>

SDE M10-Smart M2 RS420 AresC640

TACACS privilege level

Values:

u32 – Privilege level (0-15)

Instances:

Multiple

Required:

system aaa authorization privilege-map tacacs <u32> role <id>

SDE M10-Smart M2 RS420 AresC640

Values:

id – Mapped role for privilege level

system aaa group: SDE M10-Smart M2 RS420 AresC640
AAA server group parameters

system aaa group radius <id>

SDE M10-Smart M2 RS420 AresC640

Values:

id – RADIUS AAA server group parameters

Instances:

Multiple

Required:

system aaa server radius <id>

system aaa group radius <id> local-vrf <id>

SDE M10-Smart M2 RS420 AresC640

Server group VRF

Reference:: system vrf <id>

system aaa group radius <id> server <id>

SDE M10-Smart M2 RS420 AresC640

RADIUS server

Reference:: system aaa server radius <id>
Instances:: Multiple

system aaa group radius <id> server <id> priority <u32>

SDE M10-Smart M2 RS420 AresC640

Server priority (lowest first)

Values:

u32 – Server priority (1-255)

system aaa group tacacs <id>

SDE M10-Smart M2 RS420 AresC640

Values:

id – TACACS AAA server group parameters

Instances:

Multiple

Required:

system aaa server tacacs <id>

system aaa group tacacs <id> local-vrf <id>

SDE M10-Smart M2 RS420 AresC640

Server group VRF

Reference:: system vrf <id>

system aaa group tacacs <id> server <id>

SDE M10-Smart M2 RS420 AresC640

Add a server to the group

Reference:: system aaa server tacacs <id>
Instances:: Multiple

system aaa group tacacs <id> server <id> priority <u32>

SDE M10-Smart M2 RS420 AresC640

Server priority (lowest first)

Values:

u32 – Server priority (1-255)

system aaa list <id>

SDE M10-Smart M2 RS420 AresC640

AAA list parameters

Values:

id – AAA list name

Instances:

Multiple

system aaa list <id> method <u32>

SDE M10-Smart M2 RS420 AresC640

Values:

u32 – AAA method

Instances:

Unique

system aaa list <id> method <u32> group

SDE M10-Smart M2 RS420 AresC640

AAA server group

Instances:: Unique

system aaa list <id> method <u32> group radius <id>

SDE M10-Smart M2 RS420 AresC640

RADIUS server group

Reference:: system aaa group radius <id>

system aaa list <id> method <u32> group tacacs <id>

SDE M10-Smart M2 RS420 AresC640

TACACS server group

Reference:: system aaa group tacacs <id>

system aaa list <id> method <u32> local: SDE M10-Smart M2 RS420 AresC640
Local user database

system aaa server: SDE M10-Smart M2 RS420 AresC640
AAA server parameters

system aaa server radius <id>

SDE M10-Smart M2 RS420 AresC640

Values:

id – RADIUS server parameters

Instances:

Multiple

Required:

system aaa server radius <id> accounting-port <u32>

SDE M10-Smart M2 RS420 AresC640

Accounting port

Values:

u32 – Numeric IP port (1-65535)

system aaa server radius <id> address <ipv4|ipv6|fqdn>

SDE M10-Smart M2 RS420 AresC640

RADIUS server parameters configuration

Values:

ipv4 – RADIUS server IPv4 address
ipv6 – RADIUS server IPv6 address
fqdn – RADIUS server hostname

system aaa server radius <id> encrypted-key <password>

SDE M10-Smart M2 RS420 AresC640

Values:

password – Encrypted key

system aaa server radius <id> key <txt>

SDE M10-Smart M2 RS420 AresC640

Values:

txt –
Shared secret key

These characters are allowed to be used for setting the shared key: alphanumeric characters: a-z A-Z 0-9 special characters: - + & ! @ # $ %% ^ * ( ) , . : _ It is recommended to use single quotes (’) for setting the shared-secret key. If special characters are being used, then single quotes are mandatory

system aaa server radius <id> local-address <ipv4|ipv6>

SDE M10-Smart M2 RS420 AresC640

Source IP address used to initiate connection

Values:

ipv4 – IPv4 source address
ipv6 – IPv6 source address

Local IP address:

system aaa server radius <id> port <u32>

SDE M10-Smart M2 RS420 AresC640

Authentication port

Values:

u32 – Numeric IP port (1-65535)

system aaa server radius <id> timeout <u32>

SDE M10-Smart M2 RS420 AresC640

Session timeout

Values:

u32 – Session timeout in seconds (1-30)

system aaa server radius <id> vpn: SDE M10-Smart M2 RS420 AresC640
VPN-specific parameters

system aaa server radius <id> vpn ipsec: SDE M10-Smart M2 RS420 AresC640
IPSec-specific parameters

system aaa server radius <id> vpn ipsec preference <u32>

SDE M10-Smart M2 RS420 AresC640

Specific priority of this server

This value allows (or denies) using another RADIUS server if the one which is being configured becomes unresponsive. A reachable server automatically gets a priority in between 110 and 210 (proportionally, higher is better). But be aware that a value higher than 110 will mark the server as a reachable even if it is not.

Values:

u32 – Fair selection based on server load (0)
u32 – Prefer this server, as long as it is completely unloaded (1)
u32 – Prefer this server, unless more than half of the sockets are in use (50)
u32 – Always prefer this server, unless no sockets are currently available (99)
u32 – Always prefer the server, unless it gets unreachable (101)
u32 – Always use this server, even if it gets unreachable [DANGEROUS] (110-210)
u32 – Allowed priority values (0-210)

system aaa server radius <id> vpn ipsec sockets <u32>

SDE M10-Smart M2 RS420 AresC640

Pre-allocated sockets to use

A single RADIUS client port can handle only one concurrent authentication session. Defining multiple client ports can help doing parallel authentication in high load scenarios. Notice that the higher this value is the higher the resources used are. Each server will have this amount of sockets, be careful changing this setting (10 servers with 5 sockets each one = 50 pre-allocated sockets)

Values:

u32 – Pre-allocated sockets per each server (1-1024)

system aaa server radius <id> vpn ipsec sockets <u32> nas-identifier <id>

SDE M10-Smart M2 RS420 AresC640

Values:

id –
Identification used against the RADIUS server

These characters are allowed to be used when defining the identifier:

system aaa server tacacs <id>

SDE M10-Smart M2 RS420 AresC640

Values:

id – RADIUS server parameters

Instances:

Multiple

Required:

system aaa server tacacs <id> address <ipv4|ipv6|fqdn>

SDE M10-Smart M2 RS420 AresC640

Server address

Values:

ipv4 – TACACS server IPv4 address
ipv6 – TACACS server IPv6 address
fqdn – TACACS server hostname

system aaa server tacacs <id> encrypted-key <password>

SDE M10-Smart M2 RS420 AresC640

Values:

password – Encrypted key

system aaa server tacacs <id> key <txt>

SDE M10-Smart M2 RS420 AresC640

Values:

txt –
Shared secret key

These characters are allowed to be used for setting the shared key: alphanumeric characters: a-z A-Z 0-9 special characters: - + & ! @ # $ %% ^ * ( ) , . : _ It is recommended to use single quotes (’) for setting the shared-secret key. If special characters are being used, then single quotes are mandatory

system aaa server tacacs <id> local-address <ipv4|ipv6>

SDE M10-Smart M2 RS420 AresC640

Source IP address used to initiate connection

Values:

ipv4 – IPv4 source address
ipv6 – IPv6 source address

Local IP address:

Instances:

Multiple

system aaa server tacacs <id> port <u32>

SDE M10-Smart M2 RS420 AresC640

Authentication port

Values:

u32 – Numeric IP port (1-65535)

system aaa server tacacs <id> protocol <id>

SDE M10-Smart M2 RS420 AresC640

Values:

id – Protocol type

system aaa server tacacs <id> service <id>

SDE M10-Smart M2 RS420 AresC640

Values:

id – Service type