Administrator Guide

NOTE: Unsupported attributes are the ones that are not mentioned in the RFC 5176 but present in the disconnect
message that is received by the NAS.
• rejects the disconnect message containing NAS-IP-Address or NAS-IPV6-Address attribute that does not match NAS with DM-Nak;
Error-Cause value is “NAS Identification Mismatch” (403).
• responds with a DM-Nak, if the NAS is configured to prohibit honoring of disconnect messages; Error-Cause value is “Administratively
Prohibited” (501).
Configuring DAC
You can configure trusted dynamic authorization clients (DACs).
This setting enables you to configure more than one DAC. Duplicate configurations are not allowed.
1. Enter the following command to enter dynamic authorization mode:
radius dynamic-auth
2. Enter the following command to configure DAC:
client host-name
Dell(conf-dynamic-auth#)client testhost
Configuring the port number
You can configure the port number on which the NAS receives CoA or DM requests.
This setting enables you to specify an optional port number on which to receive CoA or DM requests. The default value is 3799.
Enter the following command to configure the port number:
port port-number
The range for the port number value that you can specify is from 1 to 65535.
Dell(conf-dynamic-auth#)port 2000
Configuring shared key
You can configure a global shared key for the dynamic authorization clients (DACs).
1. Enter the following command to enter dynamic authorization mode:
radius dynamic-auth
2. Enter the following command to configure the global shared key value:
client-key encryption-type key
Dell(conf-dynamic-auth#)client-key 7 password
Disconnecting administrative users logged in through RADIUS
Dell EMC Networking OS enables you to configure disconnect messages (DMs) to disconnect RADIUS administrative users who are
logged in through an AAA interface.
Before disconnecting an administrative user using the disconnect messages, ensure that the following prerequisites are satisfied:
• Shared key is configured in NAS for DAC.
• NAS server listens on the Management IP UDP port 3799 (default) or the port configured through CLI.
• AAA session for the user is active.
NAS uses the user-name or both the user-name as well as the NAS-Port attribute to identify the AAA user session. NAS disconnects all
sessions related to the user, if the user-name is provided without NAS-port.
1. Enter the following command to configure the dynamic authorization feature:
radius dynamic-auth
2. Enter the following command to terminate the 802.1x user session:
disconnect-user
NAS disconnects the administrative users who are connected through an AAA interface.
Dell(conf#)radius dynamic-auth
Dell(conf-dynamic-auth#)disconnect-user
818
Security