Previous Section  < Day Day Up >  Next Section

Defining an Authentication Server

Before configuring an authentication server on Cisco ASA, you must specify AAA server groups with the aaa-server command. The syntax of the aaa-server command to specify a new AAA server group and the respective protocol is as follows:

  aaa-server server-tag protocol server-protocol

server-tag is the server group name that is referenced by the other AAA command, and server-protocol is the name of the supported AAA protocol. Example 7-1 shows the different authentication protocols that can be defined within a AAA server group.

Example 7-1. AAA Server Group Authentication Protocols
Chicago(config)# aaa-server mygroup protocol ?

  kerberos  Protocol Kerberos

  ldap      Protocol LDAP

  nt        Protocol NT

  radius    Protocol RADIUS

  sdi       Protocol SDI

  tacacs+   Protocol TACACS+

In Example 7-1, the AAA server group tag is named mygroup. After defining the AAA server group with the respective authentication protocol, you are shown the (config-aaa-server) prompt, which has several subcommands and options that are shown in Example 7-2.

Example 7-2. AAA Server Group Configuration Options
Chicago(config)# aaa-server mygroup protocol radius

Chicago(config-aaa-server)# ?

aaa-server group configuration commands:

  accounting-mode      Enter this keyword to specify accounting mode

  max-failed-attempts  Specify the maximum number of failures that will be allowed

  for any server in the group before that server is deactivated

  no                   Remove an item from aaa-server group configuration

  reactivation-mode    Specify the method by which failed servers are reactivated

In Example 7-2, the AAA server group mygroup was configured for RADIUS authentication. You can specify the accounting mode using the accounting-mode subcommand with one of these options:

  • simultaneous— Indicates that accounting messages are sent to all servers in the group

  • single— Indicates that accounting messages are sent to a single server

Note

Accounting mode options are available only if you are configuring a AAA server group for RADIUS or TACACS+.


The max-failed-attempts subcommand specifies the maximum allowed number of communication failures for any server in the AAA server group before that server is disabled or deactivated. The maximum number of failures can be configured in a range from 1 to 5.

Cisco ASA supports two different AAA server reactivation policies or modes:

  • Timed mode— The failed or deactivated servers are reactivated after 30 seconds of downtime. Example 7-3 includes the subcommand to enable server reactivation in timed mode.

  • Depletion mode— The failed or deactivated servers remain inactive until all other servers within the configured group are inactive. Example 7-4 shows the Cisco ASA configured with a server group called mygroup, a maximum allowed number of communication failures set to 4, and server reactivation in depletion mode.

Example 7-3. AAA Server Reactivation in Timed Mode
Chicago(config-aaa-server)# reactivation-mode timed

Example 7-4. AAA Server Reactivation in Depletion Mode
Chicago# configure terminal

Chicago(config)# aaa-server mygroup protocol radius

Chicago(config-aaa-server)# max-failed-attempts 4

Chicago(config-aaa-server)# reactivation-mode depletion deadtime 5

Chicago(config-aaa-server)# exit

Chicago(config)# exit

The deadtime keyword stipulates the amount of time that will elapse between the disabling of the last server in the group and the subsequent re-enabling of all servers. The deadtime value in this example is set to 5 minutes.

To specify the AAA servers that will belong to specific groups, use the following command:

  aaa-server server-tag host ip_address

Example 7-5 shows all the AAA server host configuration options.

Example 7-5. AAA Server Host Available Configuration Options
Chicago(config-aaa-server)# ?

aaa-server host configuration commands:

  accounting-port      Specify the port number to be used for accounting

  authentication-port  Specify the port number to be used for authentication

  key                  Specify the secret used to authenticate the NAS to the AAA

                       server

  no                   Remove an item from aaa-server host configuration

  radius-common-pw     Specify a common password for all RADIUS authorization

                       transactions

  retry-interval       Specify the amount of time between retry attempts

  timeout              Specify the maximum time to wait for response from configured

                       server

Example 7-6 shows the Cisco ASA configured with two AAA servers under the server group called mygroup.

Example 7-6. AAA Server Host Configuration
Chicago# configure terminal

Chicago(config)# aaa-server mygroup host 172.18.124.11

Chicago(config-aaa-server)# retry-interval 3

Chicago(config-aaa-server)# timeout 30

Chicago(config-aaa-server)# key cisco123

Chicago(config-aaa-server)# exit

Chicago(config)# aaa-server mygroup host 172.18.124.12

Chicago(config-aaa-server)# retry-interval 3

Chicago(config-aaa-server)# timeout 30

Chicago(config-aaa-server)# key cisco123

Chicago(config-aaa-server)# exit

Chicago(config)# exit

To view statistics about all AAA servers defined for a specific protocol, use the following command:

  show aaa-server protocol server-protocol

Example 7-7 includes the output of this command for the RADIUS protocol.

Example 7-7. Output of the show aaa-server protocol Command
Chicago# show aaa-server protocol radius

Server Group:    mygroup

Server Protocol: radius

Server Address:  172.18.124.11

Server port:     1645(authentication), 1646(accounting)

Server status:   ACTIVE, Last transaction at unknown

Number of pending requests              0

Average round trip time                 0ms

Number of authentication requests       55

Number of authorization requests        13

Number of accounting requests           45

Number of retransmissions               0

Number of accepts                       54

Number of rejects                       1

Number of challenges                    54

Number of malformed responses           0

Number of bad authenticators            0

Number of timeouts                      0

Number of unrecognized responses        0

Server Group:    mygroup

Server Protocol: radius

Server Address:  172.18.124.12

Server port:     1645(authentication), 1646(accounting)

Server status:   ACTIVE, Last transaction at unknown

Number of pending requests              0

Average round trip time                 0ms

Number of authentication requests       0

Number of authorization requests        0

Number of accounting requests           0

Number of retransmissions               0

Number of accepts                       0

Number of rejects                       0

Number of challenges                    0

Number of malformed responses           0

Number of bad authenticators            0

Number of timeouts                      0

Number of unrecognized responses        0

Chicago#

To show the configuration of a specific AAA server, use the following command:

  show running-config aaa-server [server-group [(if_name) host ip_address]]

To show statistics about a specific AAA server, use the following command:

  show aaa-server [server-tag [host hostname]]

Example 7-8 includes the output of this command for server 172.18.124.11.

Example 7-8. Output of the show aaa-server Command for a Specific Host
Chicago# show aaa-server mygroup host 172.18.124.11

Server Group:    mygroup

Server Protocol: radius

Server Address:  172.18.124.11

Server port:     1645(authentication), 1646(accounting)

Server status:   ACTIVE, Last transaction at unknown

Number of pending requests              0

Average round trip time                 0ms

Number of authentication requests       55

Number of authorization requests        13

Number of accounting requests           45

Number of retransmissions               0

Number of accepts                       54

Number of rejects                       1

Number of challenges                    54

Number of malformed responses           0

Number of bad authenticators            0

Number of timeouts                      0

Number of unrecognized responses        0

To clear the AAA server statistics for a specific server, use this command:

  clear aaa-server statistics [tag [host hostname]]

To clear the AAA server statistics for all servers providing services for a specific protocol, use this command:

  clear aaa-server statistics protocol server-protocol

To clear a specific AAA server group, use this command:

  clear configure aaa-server [server-tag]

    Previous Section  < Day Day Up >  Next Section