topic 802.1x Radius Dynamic Author in Network Access Control

802.1x Radius Dynamic Author

iores — Sun, 16 Apr 2023 21:00:21 GMT

Hi,

what is the meaning of these command lines:

aaa server radius dynamic-author

client 10.1.1.1 server-key shared_secret

More specifically, what does the 'client' stands for when the IP address is IP of Radius server.

Thank you.

Re: 802.1x Radius Dynamic Author

Arne Bier — Sun, 16 Apr 2023 21:07:56 GMT

In RADIUS there is always a client that makes the requests, and the server that processes the requests. When RADIUS was invented many years ago, the RADIUS Server was always the server - waiting for NAS clients (wireless controller, switches, VPN, broadband concentrators, etc) to send requests. But an enhancement was made to the RADIUS protocol to allow the server to also initiate requests - this time, the server initiates the request to the NAS - therefore on the switch, you have to list the IP addresses of the RADIUS servers that are allowed to make requests to the NAS. A RADIUS server will only send a CoA (Change of Authorization) request to a NAS. This is for re-authentication and disconnect and other things.

Re: 802.1x Radius Dynamic Author

Nancy Saini — Mon, 17 Apr 2023 07:45:49 GMT

Adding to what @Arne Bier mentioned, the dynamic-author command is required for switch to accept RADIUS CoA (Change of Authorization) request coming from the RADIUS server and the network device acknowledging it with CoA Ack.