RADIUS DTLS

Information About RADIUS DTLS

The Remote Authentication Dial-In User Service (RADIUS) is a client or server protocol that provides centralized security for users attempting to gain management access to a network. The RADIUS protocol is a widely deployed authentication and authorization protocol that delivers a complete Authentication, Authorization, and Accounting (AAA) solution.

RADIUS DTLS Port

The RADIUS port (DTLS server) is used for authentication and accounting. The default DTLS server port is 2083.

You can change the RADIUS DTLS port number using dtls port port_number . For more information, see the Configuring RADIUS DTLS Port Number section.

Shared Secret

You can use radius/dtls as the shared secret, if you have enabled DTLS for a specific server.

Handling PAC for CTS Communication

You can download PAC from ISE for CTS communication. Once the PAC is downloaded, you need to encrypt all the CTS attributes with the PAC key instead of the shared secret.

The ISE then decrypts these attributes using PAC.

Session Management

The RADIUS client purely depends on the response from the DTLS server. If the session is ideal for ideal timeout, then the session must be closed.

In case of invalid responses, the sessions must be deleted.

If you need to send the radius packets over DTLS, the DTLS session needs to be re-established with the specific server.

Load Balancing

Multiple DTLS servers and load balancing methods are configured.

You need to select the AAA server to which the request needs to be sent. Then use the DTLS context of the specific server to encrypt the RADIUS packet and send it back.

Connection Timeout

After the encrypted RADIUS packet is sent, you need to start the retransmission timer. If you do not get a response before the retransmission timer expires, the packet is re-encrypted and re-transmitted.

You can continue for number of times as per the dtls retries configuration or till the default value. Once the number of tries exceeds the limit, the server becomes unavailable and responses are sent back to the AAA clients.


Note

The default connection timeout is 5 seconds.

Connection Retries

As the RADIUS DTLS is UDP based, you need to retry the connection after a specific timeout interval for a specific number of retries.

After all retries are exhausted, the DTLS connection performs the following:

  • Is marked as unsuccessful.

  • Looks up for the next available server for processing the RADIUS requests.


Note

The default connection retries is 5.

Idle Timeout

When the idle timer expires and no transactions exists since the last idle timeout, the DTLS session remains closed.

After you establish the DTLS session, you can start the idle timer. If you start the idle timer for 30 seconds and one of the RADIUS DTLS packet is sent, then after 30 seconds, the idle timer expires and checks for number of RADIUS DTLS transactions.

If the idle timer value exceeds zero, the idle timer resets the transaction counter and restarts the timer.


Note

The default idle timeout is 60 seconds.

Handling Server and Server Group Failover

You can configure RADIUS servers with and without DTLS. It is recommended to create AAA server groups with DTLS enabled servers and non-DTLS servers. However, you will not find any such restriction while configuring AAA server groups.

Suppose you choose a DTLS server, the DTLS server establishes connection and RADIUS request packet is sent to the DTLS server. If the DTLS server does not respond after all RADIUS retries, it would fall over to the next configured server in the same server group. If the next server is a DTLS server, the processing of the RADIUS request packet continues with the next server. If the next server is a non-DTLS server, the processing of RADIUS request packet does not happen in that server group. Then the server group failover occurs and the same sequence continues with the next server group, if the next server group is available.


Note

You need to use either only DTLS or non-DTLS servers in a server group.

Prerequisites

Support for IOS and BINOS AAA

The AAA server runs in IOS and BINOS platforms. Once you complete the RADIUS DTLS support in IOS, the same needs to be ported to BINOS.

Configuring RADIUS DTLS Server

Procedure

  Command or Action Purpose

Step 1

enable

Example:

Device# enable

Enters privileged EXEC mode.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

radius server server-name

Example:

Device(config)# radius server R1

Specifies the RADIUS server name.

Step 4

dtls

Example:

Device(config-radius-server)# dtls

Configures DTLS parameters.

Step 5

end

Example:

Device(config-radius-server)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring RADIUS DTLS Connection Timeout

Procedure

  Command or Action Purpose

Step 1

enable

Example:

Device# enable

Enters privileged EXEC mode.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

radius server server-name

Example:

Device(config)# radius server R1

Specifies the RADIUS server name.

Step 4

dtls connectiontimeout timeout

Example:

Device(config-radius-server)# dtls connectiontimeout 1

Configures RADIUS DTLS connection timeout.

Here,

timeout refers to the DTLS connection timeout value. The valid range is from 1 to 65535.

Step 5

end

Example:

Device(config-radius-server)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring RADIUS DTLS Idle Timeout

Procedure

  Command or Action Purpose

Step 1

enable

Example:

Device# enable

Enters privileged EXEC mode.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

radius server server-name

Example:

Device(config)# radius server R1

Specifies the RADIUS server name.

Step 4

dtls idletimeout idle_timeout

Example:

Device(config-radius-server)# dtls idletimeout 2

Configures RADIUS DTLS idle timeout.

Here,

idle_timeout refers to the DTLS idle timeout value. The valid range is from 1 to 65535.

Step 5

end

Example:

Device(config-radius-server)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring Source Interface for RADIUS DTLS Server

Procedure

  Command or Action Purpose

Step 1

enable

Example:

Device# enable

Enters privileged EXEC mode.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

radius server server-name

Example:

Device(config)# radius server R1

Specifies the RADIUS server name.

Step 4

dtls ip {radius source-interface Ethernet-Internal interface_number

Example:

Device(config-radius-server)# dtls ip radius source-interface Ethernet-Internal 0

Configures source interface for RADIUS DTLS server.

Here,

  • interface_number refers to the Ethernet-Internal interface number. The default value is 0.

Step 5

end

Example:

Device(config-radius-server)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring RADIUS DTLS Port Number

Procedure

  Command or Action Purpose

Step 1

enable

Example:

Device# enable

Enters privileged EXEC mode.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

radius server server-name

Example:

Device(config)# radius server R1

Specifies the RADIUS server name.

Step 4

dtls port port_number

Example:

Device(config-radius-server)# dtls port 2

Configures RADIUS DTLS port number.

Here,

port_number refers to the DTLS port number.

Step 5

end

Example:

Device(config-radius-server)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring RADIUS DTLS Connection Retries

Procedure

  Command or Action Purpose

Step 1

enable

Example:

Device# enable

Enters privileged EXEC mode.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

radius server server-name

Example:

Device(config)# radius server R1

Specifies the RADIUS server name.

Step 4

dtls retries retry_number

Example:

Device(config-radius-server)# dtls retries 3

Configures RADIUS connection retries.

Here,

retry_number refers to the DTLS connection retries. The valid range is from 1 to 65535.

Step 5

end

Example:

Device(config-radius-server)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring RADIUS DTLS Trustpoint

Procedure

  Command or Action Purpose

Step 1

enable

Example:

Device# enable

Enters privileged EXEC mode.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

radius server server-name

Example:

Device(config)# radius server R1

Specifies the RADIUS server name.

Step 4

dtls trustpoint {client LINE dtls | server LINE dtls}

Example:

Device(config-radius-server)# dtls trustpoint client client1 dtls
Device(config-radius-server)# dtls trustpoint server server1 dtls

Configures trustpoint for client and server.

Step 5

end

Example:

Device(config-radius-server)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring RADIUS DTLS Match-Server-Identity

Procedure

  Command or Action Purpose

Step 1

enable

Example:

dtls match-server-identity hostname <name>

Configure the RADSEC certification validation parameters.

Step 2

enable

Example:

dtls match-server-identity ip-address <IPv4 or IPv6>

Configure the RADSEC certification validation parameters.

Configuring DTLS Dynamic Author

Procedure

  Command or Action Purpose

Step 1

enable

Example:

Device# enable

Enters privileged EXEC mode.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

aaa server radius dynamic-author

Example:

Device(config)# aaa server radius dynamic-author

Configures local server profile for RFC 3576 support.

Step 4

dtls

Example:

Device(config-locsvr-da-radius)# dtls

Configures DTLS source parameters.

Step 5

end

Example:

Device(config-locsvr-da-radius)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Enabling DTLS for Client

Procedure

  Command or Action Purpose

Step 1

enable

Example:

Device# enable

Enters privileged EXEC mode.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

aaa server radius dynamic-author

Example:

Device(config)# aaa server radius dynamic-author

Configures local server profile for RFC 3576 support.

Step 4

client IP_addr dtls

Example:

Device(config-locsvr-da-radius)# client 10.104.49.14 dtls

Enables DTLS for the client.

Step 5

end

Example:

Device(config-locsvr-da-radius)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring Client Trustpoint for DTLS

Procedure

  Command or Action Purpose

Step 1

enable

Example:

Device# enable

Enters privileged EXEC mode.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

aaa server radius dynamic-author

Example:

Device(config)# aaa server radius dynamic-author

Configures local server profile for RFC 3576 support.

Step 4

client IP_addr dtls {client-tp client-tp-name | server-tp server-tp-name}

Example:

Device(config-locsvr-da-radius)# client 10.104.49.14 dtls client-tp client_tp_name

Configures client trustpoint for DTLS.

Step 5

end

Example:

Device(config-locsvr-da-radius)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring DTLS Idle Timeout

Procedure

  Command or Action Purpose

Step 1

enable

Example:

Device# enable

Enters privileged EXEC mode.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

aaa server radius dynamic-author

Example:

Device(config)# aaa server radius dynamic-author

Configures local server profile for RFC 3576 support.

Step 4

client IP_addr dtls idletimeout timeout-interval {client-tp client_tp_name | server-tp server_tp_name}

Example:

Device(config-locsvr-da-radius)# client 10.104.49.14 dtls idletimeout 62 client-tp dtls_ise

Configures DTLS idle time.

Here,

timeout-interval refers to the idle timeout interval. The valid range is from 60 to 600.

Step 5

end

Example:

Device(config-locsvr-da-radius)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring Server Trustpoint for DTLS

Procedure

  Command or Action Purpose

Step 1

enable

Example:

Device# enable

Enters privileged EXEC mode.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

aaa server radius dynamic-author

Example:

Device(config)# aaa server radius dynamic-author

Configures local server profile for RFC 3576 support.

Step 4

client IP_addr dtls server-tp server_tp_name

Example:

Device(config-locsvr-da-radius)# client 10.104.49.14 dtls server-tp dtls_client

Configures server trust point.

Step 5

end

Example:

Device(config-locsvr-da-radius)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Verifying the RADIUS DTLS Server Configuration

To view information about the DTLS enabled servers, use the following command:

Device# show aaa servers
DTLS: Packet count since last idletimeout 1,
Send handshake count 3,
Handshake Success 1,
Total Packets Transmitted 1,
Total Packets Received 1,
Total Connection Resets 2,
Connection Reset due to idle timeout 0,
Connection Reset due to No Response 2,
Connection Reset due to Malformed packet 0,

Clearing RADIUS DTLS Specific Statistics

To clear the radius DTLS specific statistics, use the following command:

Device# clear aaa counters servers radius {<server-id> | all}

Note

Here, server-id refers to the server ID displayed by show aaa servers . The valid range is from 0 to 2147483647.