Page History

Overview

The

Since 3.1 release, 

• Administrator
• Operator
• FieldService
• Guest
• SecurityAuditor
• Calea

Since the RADIUS protocol does not provide a means to assign users to a group, the implementation currently hard codes every RADIUS authenticated user to the Administrator group.

The

• Obtain Correct Privileges via RADIUS Transaction – When a user is authenticated using RADIUS, the correct privilege is obtained via RADIUS transaction itself using a Vendor Specific Attribute (VSA).
  
  
• Configure Multiple RADIUS Servers – Up to three RADIUS servers are now configurable per

  Spacevars
  0 product

  .

To configure RADIUS authentication for

Anchor
privileges privileges

Obtain Correct Privileges via RADIUS Transaction

When a user is authenticated via RADIUS, the user is assigned to a group provided by the RADIUS server as part of the ACCESS_ACCEPT packet.

For

0               1               2               3       
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Type      |  Length       |            Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     Vendor-Id (cont)           | Vendor type   | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Attribute-Specific...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

The Vendor-Id is a SMI Network Management Private Enterprise Code of the vendor Sonus as specified in RFC 2865.

• Vendor ID for Sonus is "2879".
• Vendor type can be "1" considering this is the first instance of using VSAs. Type "1" can be the identifier for a group name from server.
• Vendor length is the length of the group name itself. This is followed by a string consisting of a case-sensitive group name.

If the RADIUS server does not provide a group or provides a group name which is not present in the

the

Anchor
multiple servers multiple servers

Configure Multiple RADIUS Servers

The

When more than one RADIUS server is configured and RADIUS authentication is attempted, the server configured with the least priority value is tried first. If fallback is configured, the inverse priority order is followed to pick the next server for authentication. SBC allows a configurable number of retries and time-outs before retry.

Once the

SBC includes statistics to check the status of a RADIUS server, as well as the time when an unavailable server automatically becomes available again. See "radiusAuthentication" statistic details at

Show Table OAM or Show Status OAM pages.

Enable Remote Authentication

To enable remote authentication:

1. Login to SBC CLI.
   
   

2. Change to the Configuration mode:

   Code Block
   language none
   > configure private

   Span

3. Execute the following command:

   Code Block
   language none
   % set system admin <system name> localAuthenticationEnabled false externalAuthenticationEnabled true

Configure RADIUS Server

To configure the remote RADIUS Server:

1. Logon to

   Spacevars
   0 product

    CLI.
    

2. Change to the Configuration mode:

   Code Block
   language none
   > configure private

   Span

3. Execute the following command:

   Code Block
   language none
   % set oam radiusAuthentication radiusServer <server name> mgmtInterfaceGroup <string> priority <#> radiusNasIp <x.x.x.x> radiusServerIp <x.x.x.x> radiusServerPort <#> radiusSharedSecret <8-128> state <disabled | enabled> retryCriteria oosDuration <# minutes> retryCount <#> retryTimer <# milliseconds>

The supports all alphabetical, numeric, and special characters for setting the radiusSharedSecret key.

The following characters in the key must be escaped while setting a radiusSharedSecret for configuring a RADIUS server:

• # (hash) anywhere in the key
• \ (backslash) anywhere in the key
• “ (double quotes) at the beginning or end of the key

For example,

• Un-escaped key: ThisIsARadiusKeyWithDoubleQuote”andBackSlash\Hash#andAdoubleQuoteAtTheEnd”
• Escaped string: ThisIsARadiusKeyWithDoubleQuote”andBackSlash\\Hash\#andAdoubleQuoteAtTheEnd\”