- Configuring Authentication
- RADIUS Change of Authorization
- Message Banners for AAA Authentication
- AAA-Domain Stripping at Server Group Level
- AAA Double Authentication Secured by Absolute Timeout
- Throttling of AAA RADIUS Records
- RADIUS Packet of Disconnect
- AAA Authorization and Authentication Cache
- Configuring Authorization
- Configuring Accounting
- AAA-SERVER-MIB Set Operation
- Per VRF AAA
- AAA Support for IPv6
- TACACS+ over IPv6
- AAA Dead-Server Detection
- Login Password Retry Lockout
- MSCHAP Version 2
- AAA Broadcast Accounting-Mandatory Response Support
Contents
- AAA-Domain Stripping at Server Group Level
- Finding Feature Information
- Information About AAA-Domain Stripping at Server Group Level
- How to Configure AAA-Domain Stripping at Server Level Group
- Configuring Domain Stripping at the Server Group Level
- Configuration Example for AAA-Domain Stripping at Server Group Level
- Example: AAA-Domain Stripping at Server Group Level
- Additional References
- Feature Information for AAA-Domain Stripping at Server Group Level
AAA-Domain Stripping at Server Group Level
The AAA-Domain Stripping at Server Group Level feature allows domain stripping to be configured at the server group level.
- Finding Feature Information
- Information About AAA-Domain Stripping at Server Group Level
- How to Configure AAA-Domain Stripping at Server Level Group
- Configuration Example for AAA-Domain Stripping at Server Group Level
- Additional References
- Feature Information for AAA-Domain Stripping at Server Group Level
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Information About AAA-Domain Stripping at Server Group Level
You can remove the domain name from the username received at the global level by using the radius-server domain-stripping command. When the radius-server domain-stripping command is configured, all the AAA requests with “user@example.com” go to the remote RADIUS server with the reformatted username “user”. The domain name is removed from the request.
 Note | Domain stripping will not be done in a TACACS configuration. |
The AAA Broadcast Accounting feature allows accounting information to be sent to multiple AAA servers at the same time, that is, accounting information can be broadcast to one or more AAA servers simultaneously. This functionality allows you to send accounting information to private and public AAA servers. It also provides redundant billing information for voice applications.
You can configure domain stripping at the server group level by using the domain-stripping command in server group RADIUS configuration mode. Per-server group configuration overrides the global configuration. If domain stripping is not enabled globally, but it is enabled in a server group, then it is enabled only for that server group. Also, if virtual routing and forwarding (VRF)-specific domain stripping is configured globally and in a server group for a different VRF, domain stripping is enabled in both the VRFs. VRF configurations are taken from server-group configuration mode. If server-group configurations are disabled in global configuration mode but are available in server-group configuration mode, all configurations in server-group configuration mode are applicable.
After the domain stripping and broadcast accounting are configured, you can create separate accounting records as per the configurations.
How to Configure AAA-Domain Stripping at Server Level Group
Configuring Domain Stripping at the Server Group Level
1.
enable
2.
configure
terminal
3.
aaa
new-model
4.
aaa
group
server
radius
server-name
5.
domain-stripping
[strip-suffix
word]
[right-to-left
]
[prefix-delimiter
word]
[delimiter
word]
6.
end
DETAILED STEPS
Configuration Example for AAA-Domain Stripping at Server Group Level
Example: AAA-Domain Stripping at Server Group Level
The following example shows the domain stripping configuration at the server group level:
Device> enable Device# configure terminal Device(config)# aaa new-model Device(config)# aaa group server radius rad1 Device(config-sg-radius)# domain-stripping right-to-left delimiter @$/ Device(config-sg-radius)# end
Additional References
The following sections provide references related to the Configuring Authentication feature.
Related Documents
|
Related Topic |
Document Title |
|---|---|
|
Authorization |
Configuring Authorization in the Cisco IOS XE Security Configuration Guide: Securing User Services, Release 2. |
|
Accounting |
Configuring Accounting in the Cisco IOS XE Security Configuration Guide: Securing User Service , Release 2. |
|
Security commands |
Cisco IOS Security Command Reference |
Standards
|
Standard |
Title |
|---|---|
|
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. |
-- |
MIBs
|
MIB |
MIBs Link |
|---|---|
|
No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature. |
To locate and download MIBs for selected platforms, Cisco IOS XE software releases, and feature sets, use Cisco MIB Locator found at the following URL: |
RFCs
|
RFC |
Title |
|---|---|
|
RFC 1334 |
PPP Authentication Protocols |
|
RFC 2433 |
Microsoft PPP CHAP Extensions |
|
RFC 2903 |
Generic AAA Architecture |
|
RFC 2904 |
AAA Authorization Framework |
|
RFC 2906 |
AAA Authorization Requirements |
|
RFC 2989 |
Criteria for Evaluating AAA Protocols for Network Access |
Technical Assistance
|
Description |
Link |
|---|---|
|
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. |
Feature Information for AAA-Domain Stripping at Server Group Level
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Feature Name |
Releases |
Feature Information |
|---|---|---|
|
AAA-Domain Stripping at Server Group Level |
Cisco IOS XE Release 3.4S |
The AAA-Domain Stripping at Server Group Level feature allows domain stripping to be configured at the server group level. The following command was introduced: domain-stripping. |