802.1x Radius Dynamic Author

[iores]

Hi,

what is the meaning of these command lines:

aaa server radius dynamic-author

client 10.1.1.1 server-key shared_secret

 More specifically, what does the 'client' stands for when the IP address is IP of Radius server.

Thank you.

[Arne Bier]

In RADIUS there is always a client that makes the requests, and the server that processes the requests. When RADIUS was invented many years ago, the RADIUS Server was always the server - waiting for NAS clients (wireless controller, switches, VPN, broadband concentrators, etc) to send requests.  But an enhancement was made to the RADIUS protocol to allow the server to also initiate requests - this time, the server initiates the request to the NAS - therefore on the switch, you have to list the IP addresses of the RADIUS servers that are allowed to make requests to the NAS. A RADIUS server will only send a CoA (Change of Authorization) request to a NAS. This is for re-authentication and disconnect and other things.

[Nancy Saini]

Adding to what @Arne Bier mentioned, the dynamic-author command is required for switch to accept RADIUS CoA (Change of Authorization) request coming from the RADIUS server and the network device acknowledging it with CoA Ack.