aaa
- system aaa
- Devices
AAA subsystem
- system aaa authorization
- Devices
Authorization parameters
- system aaa authorization privilege-map
- Devices
Privilege level to role mapping
- system aaa authorization privilege-map radius
- Devices
RADIUS privilege level
- system aaa authorization privilege-map radius privileged
- Devices
RADIUS privileged user privilege level
- system aaa authorization privilege-map radius privileged role <id>
- Devices
- Values:
id – Mapped role
- system aaa authorization privilege-map radius standard
- Devices
RADIUS standard user privilege level
- system aaa authorization privilege-map radius standard role <id>
- Devices
- Values:
id – Mapped role
- system aaa authorization privilege-map tacacs <u32>
- Devices
TACACS privilege level
- Values:
u32 – Privilege level (0-15)
- Instances:
Multiple
- Required:
system aaa authorization privilege-map tacacs <u32> role <id>
- system aaa authorization privilege-map tacacs <u32> role <id>
- Devices
- Values:
id – Mapped role for privilege level
- system aaa group
- Devices
AAA server group parameters
- system aaa group radius <id>
- Devices
- Values:
id – RADIUS AAA server group parameters
- Instances:
Multiple
- Required:
- system aaa group radius <id> local-vrf <id>
- Devices
Server group VRF
- Reference:
- system aaa group radius <id> server <id>
- Devices
RADIUS server
- Reference:
- Instances:
Multiple
- system aaa group radius <id> server <id> priority <u32>
- Devices
Server priority (lowest first)
- Values:
u32 – Server priority (1-255)
- system aaa group tacacs <id>
- Devices
- Values:
id – TACACS AAA server group parameters
- Instances:
Multiple
- Required:
- system aaa group tacacs <id> cache-time <u32>
- Devices
Server group cache expiration time
- Values:
u32 – Disable cache (0)
u32 – Seconds to expiration (1-4294967295)
- system aaa group tacacs <id> local-vrf <id>
- Devices
Server group VRF
- Reference:
- system aaa group tacacs <id> server <id>
- Devices
Add a server to the group
- Reference:
- Instances:
Multiple
- system aaa group tacacs <id> server <id> priority <u32>
- Devices
Server priority (lowest first)
- Values:
u32 – Server priority (1-255)
- system aaa list <id>
- Devices
AAA list parameters
- Values:
id – AAA list name
- Instances:
Multiple
- system aaa list <id> method <u32>
- Devices
- Values:
u32 – AAA method
- Instances:
Unique
- system aaa list <id> method <u32> group
- Devices
AAA server group
- Instances:
Unique
- system aaa list <id> method <u32> group radius <id>
- Devices
RADIUS server group
- Reference:
- system aaa list <id> method <u32> group tacacs <id>
- Devices
TACACS server group
- Reference:
- system aaa list <id> method <u32> local
- Devices
Local user database
- system aaa server
- Devices
AAA server parameters
- system aaa server radius <id>
- Devices
- Values:
id – RADIUS server parameters
- Instances:
Multiple
- Required:
- Required:
- system aaa server radius <id> accounting-port <u32>
- Devices
Accounting port
- Values:
u32 – Numeric IP port (1-65535)
- system aaa server radius <id> address <ipv4|ipv6|fqdn|id>
- Devices
RADIUS server parameters configuration
- Values:
ipv4 – RADIUS server IPv4 address
ipv6 – RADIUS server IPv6 address
fqdn – RADIUS server hostname
dhcpv6 – Enable configuration discovery via DHCPv6 options
- system aaa server radius <id> encrypted-key <password>
- Devices
- Values:
password – Encrypted key
- system aaa server radius <id> interface <ifc>
- Devices
- Values:
ifc – Interface to obtain DHCPv6 options from
- system aaa server radius <id> key <txt>
- Devices
- Values:
txt –
Shared secret key
These characters are allowed to be used for setting the shared key: alphanumeric characters: a-z A-Z 0-9 special characters: - + & ! @ # $ %% ^ * ( ) , . : _ It is recommended to use single quotes (’) for setting the shared-secret key. If special characters are being used, then single quotes are mandatory
- system aaa server radius <id> local-address <ipv4|ipv6>
- Devices
Source IP address used to initiate connection
- Values:
ipv4 – IPv4 source address
ipv6 – IPv6 source address
- Local IP address:
- system aaa server radius <id> port <u32>
- Devices
Authentication port
- Values:
u32 – Numeric IP port (1-65535)
- system aaa server radius <id> timeout <u32>
- Devices
Session timeout
- Values:
u32 – Session timeout in seconds (1-30)
- system aaa server radius <id> vpn
- Devices
VPN-specific parameters
- system aaa server radius <id> vpn ipsec
- Devices
IPSec-specific parameters
- system aaa server radius <id> vpn ipsec preference <u32>
- Devices
Specific priority of this server
This value allows (or denies) using another RADIUS server if the one which is being configured becomes unresponsive. A reachable server automatically gets a priority in between 110 and 210 (proportionally, higher is better). But be aware that a value higher than 110 will mark the server as a reachable even if it is not.
- Values:
u32 – Fair selection based on server load (0)
u32 – Prefer this server, as long as it is completely unloaded (1)
u32 – Prefer this server, unless more than half of the sockets are in use (50)
u32 – Always prefer this server, unless no sockets are currently available (99)
u32 – Always prefer the server, unless it gets unreachable (101)
u32 – Always use this server, even if it gets unreachable [DANGEROUS] (110-210)
u32 – Allowed priority values (0-210)
- system aaa server radius <id> vpn ipsec sockets <u32>
- Devices
Pre-allocated sockets to use
A single RADIUS client port can handle only one concurrent authentication session. Defining multiple client ports can help doing parallel authentication in high load scenarios. Notice that the higher this value is the higher the resources used are. Each server will have this amount of sockets, be careful changing this setting (10 servers with 5 sockets each one = 50 pre-allocated sockets)
- Values:
u32 – Pre-allocated sockets per each server (1-1024)
- system aaa server radius <id> vpn ipsec sockets <u32> nas-identifier <id>
- Devices
- Values:
id –
Identification used against the RADIUS server
These characters are allowed to be used when defining the identifier:
- system aaa server tacacs <id>
- Devices
- Values:
id – TACACS server parameters
- Instances:
Multiple
- Required:
- Required:
- system aaa server tacacs <id> address <ipv4|ipv6|fqdn>
- Devices
Server address
- Values:
ipv4 – TACACS server IPv4 address
ipv6 – TACACS server IPv6 address
fqdn – TACACS server hostname
- system aaa server tacacs <id> encrypted-key <password>
- Devices
- Values:
password – Encrypted key
- system aaa server tacacs <id> key <txt>
- Devices
- Values:
txt –
Shared secret key
These characters are allowed to be used for setting the shared key: alphanumeric characters: a-z A-Z 0-9 special characters: - + & ! @ # $ %% ^ * ( ) , . : _ It is recommended to use single quotes (’) for setting the shared-secret key. If special characters are being used, then single quotes are mandatory
- system aaa server tacacs <id> local-address <ipv4|ipv6>
- Devices
Source IP address used to initiate connection
- Values:
ipv4 – IPv4 source address
ipv6 – IPv6 source address
- Local IP address:
- Instances:
Multiple
- system aaa server tacacs <id> port <u32>
- Devices
Authentication port
- Values:
u32 – Numeric IP port (1-65535)
- system aaa server tacacs <id> protocol <id>
- Devices
- Values:
id – Protocol type
- system aaa server tacacs <id> service <id>
- Devices
- Values:
id – Service type