RADIUS Attribute 5 (NAS-Port) Format
Specified on a Per-Server Group Level

First Published: January 24, 2005
Last Updated: September 2, 2009

The RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level feature allows configurations to be customized for different RADIUS server groups. This flexibility allows customized network access server- (NAS-) port formats to be used instead of global formats.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level" section.

Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp. An account on Cisco.com is not required.

Contents

•Prerequisites for RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level

•Information About RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level

•How to Configure RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level

•Configuration Examples for RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level

•Additional References

•Feature Information for RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level

Prerequisites for RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level

•You must be running a Cisco IOS image that contains the authentication, authorization, and accounting (AAA) component.

Information About RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level

To configure the RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level feature, you should understand the following concept:

•RADIUS Attribute 5 Format Customization

RADIUS Attribute 5 Format Customization

Prior to Cisco IOS Release 12.3(14)T, Cisco IOS software allowed RADIUS attributes that were sent in access requests or accounting requests to be customized on a global basis. You could customize how each configurable attribute should function when communicating with a RADIUS server. Since the implementation of server groups, global attribute configurations were not flexible enough to address the different customizations that were required to support the various RADIUS servers with which a router might be interacting. For example, if you configured the global radius-server attribute nas-port format command option, every service on the router that interacted with a RADIUS server was used in the same way.

Effective with Cisco IOS Release 12.3(14)T, you can configure your router to support override flexibility for per-server groups. You can configure services to use specific named methods for different service types on a RADIUS server. The service types can be set to use their own respective service groups. This flexibility allows customized NAS-port formats to be used instead of the global formats.

How to Configure RADIUS Attribute 5 (NAS-Port)
Format Specified on a Per-Server Group Level

This section contains the following procedures:

•Configuring the RADIUS Attribute 5 Format on a Per-Server Group Level

•Monitoring and Maintaining RADIUS Attribute 5 Format on a Per-Server Group Level

Configuring the RADIUS Attribute 5 Format on a Per-Server Group Level

To configure your router to support the RADIUS Attribute 5 format on a per-server group level, perform the following steps.

Note To use this per-server group capability, you must actively use a named method list within your services. You can configure one client to use a specific named method while other clients use the default format.

Prerequisites

Before performing these steps, you should first configure method lists for AAA as is applicable for your situation.

SUMMARY STEPS

1. enable

2. configure terminal

3. aaa group server radius group-name

4. server ip-address [auth-port port-number] [acct-port port-number]

5. attribute nas-port format format-type [string]

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

aaa group server radius group-name

Example:

Router (config)# aaa group server radius radius1

Groups different RADIUS server hosts into distinct lists and distinct methods and enters server-group configuration mode.

Step 4  

server ip-address [auth-port port-number] 
[acct-port port-number]
Example: 
Router (server-group)# server 172.101.159.172 
auth-port 1645 acct-port 1646

Configures the IP address of the RADIUS server for the group server.

Step 5  

attribute nas-port format format-type [string]
Example: 
Router (server-group)# attribute nas-port 
format d

Configures a service to use specific named methods for different service types.

•The service types can be set to use their own respective server groups.

Monitoring and Maintaining RADIUS Attribute 5 Format on a Per-Server Group Level

To monitor and maintain RADIUS Attribute 5 Format on a Per-Server Group Level, perform the following steps (the debug commands may be used separately):

SUMMARY STEPS

1. enable

2. debug aaa sg-server selection

3. debug radius

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

debug aaa sg-server selection

Example:

Router# debug aaa sg-server selection

Displays information about why the RADIUS and TACACS+ server group system in a router is choosing a particular server.

Step 3 

debug radius

Example:

Router# debug radius

Displays information showing that a server group has been selected for a particular request.

Configuration Examples for RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level

This section provides the following configuration example:

•RADIUS Attribute 5 Format Specified on a Per-Server Level: Example

RADIUS Attribute 5 Format Specified on a Per-Server Level: Example

The following configuration example shows a leased-line PPP client that has chosen to send no RADIUS Attribute 5 while the default is to use format d: 

interface Serial2/0

 no ip address

 encapsulation ppp

 ppp accounting SerialAccounting

 ppp authentication pap


aaa accounting network default start-stop group radius

aaa accounting network SerialAccounting start-stop group group1


aaa group server radius group1

 server 10.101.159.172 auth-port 1645 acct-port 1646

 attribute nas-port none


radius-server host 10.101.159.172 auth-port 1645 acct-port 1646

radius-server attribute nas-port format d

Additional References

The following sections provide references related to RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level.

Related Documents

Related Topic
Document Title

Cisco IOS commands

Cisco IOS Security Command Reference

Configuring AAA and AAA method lists

Cisco IOS Security Configuration Guide: Securing User Services, Release 12.4T.


Standards

Standards
Title

None

—


MIBs

MIBs
MIBs Link

None

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs


RFCs

RFCs
Title

None

—


Technical Assistance

Description
Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

http://www.cisco.com/techsupport


Feature Information for RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level

Table 1 lists the release history for this feature.

Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS and Catalyst OS software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp. An account on Cisco.com is not required.

Note Table 1 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.

Table 1 Feature Information for RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level

Feature Name
Releases
Feature Information

RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level

12.3(14)T

The RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level feature allows configurations to be customized for different RADIUS server groups. This flexibility allows customized network access server- (NAS-) port formats to be used instead of global formats.

This feature was introduced in Cisco IOS Release 12.3(14)T.

The following commands were introduced or modified: attribute nas-port format.


Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2005-2009 Cisco Systems, Inc. All rights reserved.