Got it

Example for Configuring RADIUS Authentication and Accounting - In Pratice Highlighted

Latest reply: Jun 14, 2021 17:20:46 633 61 34 0 3

OBJECTIVE


The purpose of this post is to present a real switch configuration with authentication via RADIUS server in practice.


Networking Requirements


As shown in Figure 1, users belong to the domain huawei. Switch functions as the network access server on the destination network, providing access to users only after they are remotely authenticated by the server. The remote authentication on Switch is described as follows:


The RADIUS server will authenticate access users for Switch. If RADIUS authentication fails, local authentication is used.


The RADIUS servers at 192.168.61.6/24 function as the primary and secondary authentication and accounting servers, respectively. The default authentication port and accounting port are 1812 and 1813, respectively.

img_1


Figure 1 -  Networking diagram of RADIUS authentication and accounting



Procedure


Step 1 - Configure a RADIUS server template.


# Configure a RADIUS template named ACME.


img02


# Set the IP address and port numbers for the primary RADIUS authentication and accounting server.


Img03


# Set the shared key and retransmission count for the RADIUS server, and configure the device not to encapsulate the domain name in the user name when sending RADIUS packets to the RADIUS server.


Img04


Step 2 - Configure authentication and accounting schemes.


# Create an authentication scheme named auth. Configure the authentication scheme to use RADIUS authentication as the active authentication mode and local authentication as the backup.


Img5


# Create an accounting scheme named acc, and configure the accounting scheme to use the RADIUS accounting mode. Configure a policy for the device to keep users online upon accounting-start failures.


Img06


Step 3 - Create a domain named huawei, and apply the authentication scheme auth, accounting scheme acc, and RADIUS server template ACME to the domain.


im7


Step 4 - Set the domain huawei to the global default domain.


Img_08


Step 5 - Configure local authentication.


img-09


Step 6 - Verify the configuration.


# Run the display radius-server configuration template template-name command on Switch to verify the RADIUS server template configuration.


Img10


Step 7 - Checking users on the RADIUS Server.


users


In the practical example I will be using a FREERADIUS server with address 192.168.61.6/24.


Step 8 - Logging in to the switch via RADIUS user


im11


ig12


In the practical example, we will login to the switch via users registered with RADIUS.


Step 9 - Checking the authentication log on the RADIUS server


19


In the practical example, we will be checking the authentication log on the RADIUS server.


Step 10 - Checking user information on the Switch


# Run the display access-user user andersoncf detail command on Switch to verify the user authentication and method.


img13


# Run the display access-user user huawei detail command on Switch to verify the user authentication and method.


Img14


To end our practical case, we are validating via switch that users have been authenticated via the RADIUS method.


i_f42.gifRemembering that if the server is out for some reason the authentication will be done via the local user, in our example the user "user1" that was added in the example. In another post I do the test with the failure of RADIUS and authentication via local so as not to pollute the practical example with too much information.


--- End

  • x
  • convention:

chenhui
Admin Created May 10, 2021 00:46:42

Great! We also have another article introducing the FreeRADIUS and USG firewall connection https://forum.huawei.com/enterprise/en/connect-the-usg-firewall-to-the-freeradius-server-in-eve-ng/thread/733315-861
View more
  • x
  • convention:

shakeela
shakeela Created May 15, 2021 18:16:24 (0) (0)
 
shakeela
shakeela Created May 15, 2021 18:16:33 (0) (0)
 
Unicef
MVE Created May 9, 2021 12:29:36

Well done friend
View more
  • x
  • convention:

andersoncf1
andersoncf1 Created May 9, 2021 16:22:03 (0) (0)
Thanks dear friend  
Faridrami
Faridrami Created May 11, 2021 16:48:45 (0) (0)
 
Irshadhussain
Irshadhussain Reply Faridrami  Created May 15, 2021 18:19:30 (0) (0)
 
Irshadhussain
Irshadhussain Reply Faridrami  Created May 15, 2021 18:19:38 (0) (0)
 
chenhui
Admin Created May 10, 2021 00:46:42

Great! We also have another article introducing the FreeRADIUS and USG firewall connection https://forum.huawei.com/enterprise/en/connect-the-usg-firewall-to-the-freeradius-server-in-eve-ng/thread/733315-861
View more
  • x
  • convention:

shakeela
shakeela Created May 15, 2021 18:16:24 (0) (0)
 
shakeela
shakeela Created May 15, 2021 18:16:33 (0) (0)
 
Chanbora
Created May 10, 2021 02:18:55

Good
View more
  • x
  • convention:

andersoncf1
andersoncf1 Created May 11, 2021 16:08:59 (0) (0)
Thanks friend  
Chanbora
Chanbora Reply andersoncf1  Created May 13, 2021 09:43:53 (0) (0)
 
Alex_Nazzari
Created May 10, 2021 16:20:13

Tks for sharing
View more
  • x
  • convention:

EL.BODO
EL.BODO Created May 10, 2021 18:44:37 (0) (0)
✌  
andersoncf1
andersoncf1 Created May 11, 2021 16:09:23 (0) (0)
Thanks bro  
wissal
MVE Created May 10, 2021 16:20:41

Interesting to know.
View more
  • x
  • convention:

Vlada85
MVE Author Created May 10, 2021 16:42:20

Thank you for sharing
View more
  • x
  • convention:

EL.BODO
EL.BODO Created May 10, 2021 18:44:56 (0) (0)
✌  
Adriale
Adriale Created 3 days ago (0) (0)
 
carlosalcosta
Created May 10, 2021 17:07:14

Thanks for sharing. Nice.
View more
  • x
  • convention:

Saqib123
Saqib123 Created May 10, 2021 18:22:30 (0) (0)
 
Saqib123
Saqib123 Created May 10, 2021 18:22:37 (0) (0)
 
Saqib123
Created May 10, 2021 18:21:22

Thanks for sharing
View more
  • x
  • convention:

Saqib123
Created May 10, 2021 18:21:32

Example for Configuring RADIUS Authentication and Accounting - In Pratice-3924895-1
View more
  • x
  • convention:

Comment

You need to log in to comment to the post Login | Register
Comment

Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " Privacy."

My Followers

Login and enjoy all the member benefits

Login

Block
Are you sure to block this user?
Users on your blacklist cannot comment on your post,cannot mention you, cannot send you private messages.
Reminder
Please bind your phone number to obtain invitation bonus.