Concept Guide

• Congure the number of times Dell EMC Networking OS retransmits RADIUS requests.
CONFIGURATION mode
radius-server retransmit retries
– retries: the range is from 0 to 100. Default is 3 retries.
• Congure the time interval the system waits for a RADIUS server host response.
CONFIGURATION mode
radius-server timeout seconds
–
seconds: the range is from 0 to 1000. Default is 5 seconds.
To view the conguration of RADIUS communication parameters, use the show running-config command in EXEC Privilege mode.
Monitoring RADIUS
To view information on RADIUS transactions, use the following command.
• View RADIUS transactions to troubleshoot problems.
EXEC Privilege mode
debug radius
Microsoft Challenge-Handshake Authentication Protocol Support for
RADIUS Authentication
Dell EMC Networking OS supports Microsoft Challenge-Handshake Authentication Protocol (MS-CHAPv2) with RADIUS authentication.
RADIUS is used to authenticate Telnet, SSH, console, REST, and OMI access to the switch based on the AAA conguration. By default, the
RADIUS client in the switch uses PAP (Password Authentication Protocol) for sending the login credentials to the RADIUS server. The
user-password attribute is added to the access-request message that is sent to the RADIUS server. Depending on the success or failure of
authentication, the RADIUS server sends back an access-accept or access-reject message respectively.
MS-CHAPv2 is secure than PAP. MS-CHAPv2 does not send user-password in the Access-Request message. It implements mutual
authentication based on the random challenges. MS-CHAP-Challenge and MS-CHAP2-Response attributes are sent in the Access-
Request message from the switch to the RADIUS Server. RADIUS Server validates the attributes and sends back MS-CHAPv2-Success
attribute in the Access-Accept message. If the validation fails, then RADIUS Server sends back the Access-Reject Message.
Enabling MS-CHAPv2 with the RADIUS authentication
Before enabling MS-CHAPv2 authentication on the switch, you must rst Enable MS-CHAPv2 support in RADIUS Server.
To enable MS-CHAPv2 for the RADIUS authentication:
1 Enable RADIUS.
CONFIGURATION mode
aaa authentication login default radius local
2 Specify the protocol for authentication.
CONFIGURATION mode
aaa radius auth-method mschapv2
3 Establish a host address and password.
CONFIGURATION mode
radius-server host H key K
Security
753