Defining an Authentication Server

Before configuring an authentication server on Cisco ASA, you must specify AAA server groups with the aaa-server command. The syntax of the aaa-server command to specify a new AAA server group and the respective protocol is as follows:

 aaa-server server-tag protocol server-protocol

server-tag is the server group name that is referenced by the other AAA command, and server-protocol is the name of the supported AAA protocol. Example 7-1 shows the different authentication protocols that can be defined within a AAA server group.

Example 7-1. AAA Server Group Authentication Protocols

Chicago(config)# aaa-server mygroup protocol ?

 kerberos Protocol Kerberos

 ldap Protocol LDAP

 nt Protocol NT

 radius Protocol RADIUS

 sdi Protocol SDI

 tacacs+ Protocol TACACS+

In Example 7-1, the AAA server group tag is named mygroup. After defining the AAA server group with the respective authentication protocol, you are shown the (config-aaa-server) prompt, which has several subcommands and options that are shown in Example 7-2.

Example 7-2. AAA Server Group Configuration Options

Chicago(config)# aaa-server mygroup protocol radius

Chicago(config-aaa-server)# ?

aaa-server group configuration commands:

 accounting-mode Enter this keyword to specify accounting mode

 max-failed-attempts Specify the maximum number of failures that will be allowed

 for any server in the group before that server is deactivated

 no Remove an item from aaa-server group configuration

 reactivation-mode Specify the method by which failed servers are reactivated

In Example 7-2, the AAA server group mygroup was configured for RADIUS authentication. You can specify the accounting mode using the accounting-mode subcommand with one of these options:

• simultaneous Indicates that accounting messages are sent to all servers in the group
• single Indicates that accounting messages are sent to a single server

Note

Accounting mode options are available only if you are configuring a AAA server group for RADIUS or TACACS+.

The max-failed-attempts subcommand specifies the maximum allowed number of communication failures for any server in the AAA server group before that server is disabled or deactivated. The maximum number of failures can be configured in a range from 1 to 5.

Cisco ASA supports two different AAA server reactivation policies or modes:

• Timed mode The failed or deactivated servers are reactivated after 30 seconds of downtime. Example 7-3 includes the subcommand to enable server reactivation in timed mode.
• Depletion mode The failed or deactivated servers remain inactive until all other servers within the configured group are inactive. Example 7-4 shows the Cisco ASA configured with a server group called mygroup, a maximum allowed number of communication failures set to 4, and server reactivation in depletion mode.

Example 7-3. AAA Server Reactivation in Timed Mode

Chicago(config-aaa-server)# reactivation-mode timed

 

Example 7-4. AAA Server Reactivation in Depletion Mode

Chicago# configure terminal

Chicago(config)# aaa-server mygroup protocol radius

Chicago(config-aaa-server)# max-failed-attempts 4

Chicago(config-aaa-server)# reactivation-mode depletion deadtime 5

Chicago(config-aaa-server)# exit

Chicago(config)# exit

The deadtime keyword stipulates the amount of time that will elapse between the disabling of the last server in the group and the subsequent re-enabling of all servers. The deadtime value in this example is set to 5 minutes.

To specify the AAA servers that will belong to specific groups, use the following command:

 aaa-server server-tag host ip_address

Example 7-5 shows all the AAA server host configuration options.

Example 7-5. AAA Server Host Available Configuration Options

Chicago(config-aaa-server)# ?

aaa-server host configuration commands:

 accounting-port Specify the port number to be used for accounting

 authentication-port Specify the port number to be used for authentication

 key Specify the secret used to authenticate the NAS to the AAA

 server

 no Remove an item from aaa-server host configuration

 radius-common-pw Specify a common password for all RADIUS authorization

 transactions

 retry-interval Specify the amount of time between retry attempts

 timeout Specify the maximum time to wait for response from configured

 server

Example 7-6 shows the Cisco ASA configured with two AAA servers under the server group called mygroup.

Example 7-6. AAA Server Host Configuration

Chicago# configure terminal

Chicago(config)# aaa-server mygroup host 172.18.124.11

Chicago(config-aaa-server)# retry-interval 3

Chicago(config-aaa-server)# timeout 30

Chicago(config-aaa-server)# key cisco123

Chicago(config-aaa-server)# exit

Chicago(config)# aaa-server mygroup host 172.18.124.12

Chicago(config-aaa-server)# retry-interval 3

Chicago(config-aaa-server)# timeout 30

Chicago(config-aaa-server)# key cisco123

Chicago(config-aaa-server)# exit

Chicago(config)# exit

To view statistics about all AAA servers defined for a specific protocol, use the following command:

 show aaa-server protocol server-protocol

Example 7-7 includes the output of this command for the RADIUS protocol.

Example 7-7. Output of the show aaa-server protocol Command

Chicago# show aaa-server protocol radius

Server Group: mygroup

Server Protocol: radius

Server Address: 172.18.124.11

Server port: 1645(authentication), 1646(accounting)

Server status: ACTIVE, Last transaction at unknown

Number of pending requests 0

Average round trip time 0ms

Number of authentication requests 55

Number of authorization requests 13

Number of accounting requests 45

Number of retransmissions 0

Number of accepts 54

Number of rejects 1

Number of challenges 54

Number of malformed responses 0

Number of bad authenticators 0

Number of timeouts 0

Number of unrecognized responses 0

Server Group: mygroup

Server Protocol: radius

Server Address: 172.18.124.12

Server port: 1645(authentication), 1646(accounting)

Server status: ACTIVE, Last transaction at unknown

Number of pending requests 0

Average round trip time 0ms

Number of authentication requests 0

Number of authorization requests 0

Number of accounting requests 0

Number of retransmissions 0

Number of accepts 0

Number of rejects 0

Number of challenges 0

Number of malformed responses 0

Number of bad authenticators 0

Number of timeouts 0

Number of unrecognized responses 0

Chicago#

To show the configuration of a specific AAA server, use the following command:

 show running-config aaa-server [server-group [(if_name) host ip_address]]

To show statistics about a specific AAA server, use the following command:

 show aaa-server [server-tag [host hostname]]

Example 7-8 includes the output of this command for server 172.18.124.11.

Example 7-8. Output of the show aaa-server Command for a Specific Host

Chicago# show aaa-server mygroup host 172.18.124.11

Server Group: mygroup

Server Protocol: radius

Server Address: 172.18.124.11

Server port: 1645(authentication), 1646(accounting)

Server status: ACTIVE, Last transaction at unknown

Number of pending requests 0

Average round trip time 0ms

Number of authentication requests 55

Number of authorization requests 13

Number of accounting requests 45

Number of retransmissions 0

Number of accepts 54

Number of rejects 1

Number of challenges 54

Number of malformed responses 0

Number of bad authenticators 0

Number of timeouts 0

Number of unrecognized responses 0

To clear the AAA server statistics for a specific server, use this command:

 clear aaa-server statistics [tag [host hostname]]

To clear the AAA server statistics for all servers providing services for a specific protocol, use this command:

 clear aaa-server statistics protocol server-protocol

To clear a specific AAA server group, use this command:

 clear configure aaa-server [server-tag]