Auth and Accounting Port Defaults?

[Matthew Martin]

Hello All,

I'm configuring some more of our switches/locations to start authenticating clients through our Cisco ISE server.

In the Cisco ISE v2.0 Admin Guide (*Chapter 33) under the section for configuring Switches and WLCs, it has the command below:

! Use RFC-standard ports (1812/1813)
radius-server host <Cisco_ISE_IP_address> auth-port 1812 acct-port 1813 test username test-radius key 0 <RADIUS-KEY>

However, on the current 2960 switch I'm configuring (*and I believe on every other switch I've configured already), it shows the default auth-port and acct-port as 1645 and 1646 respectively. See below:

JWP2960SALDCsw1(config)#radius-server host 10.1.2.3 ?
  acct-port	UDP port for RADIUS accounting server (default is 1646)
  alias		1-8 aliases for this server (max. 8)
  auth-port	UDP port for RADIUS authentication server (default is 1645)
  backoff	Retry backoff pattern (Default is retransmits with constant delay)
  key		per-server encryption key (overrides default)
  non-standard	Parse attributes that violate the RADIUS standard
  retransmit	Specify the number of retries to active server (overrides default)
  test		Configure server automated testing.
  timeout	Time to wait for this RADIUS server to reply (overrides default)

So what is the REAL answer here? And is there a way to check what ports the ISE server is listening on, for auth and acct..?

Thanks in Advance,
Matt

[agrissimanis · Accepted solution]

Hi Matt,

ISE is listening on both pairs of ports. It is just that 1645 and 1646 were used initially and this has been left as the default. It is recommended to use 1812 and 1813, which are now officially assigned to RADIUS, and listed in the RFCs.

Regards,

Agris

Please Mark as correct, if this answers the question

[Matthew Martin]

Agris, thanks for the reply!

Ok cool, thanks. I'll continue using 1812 and 1813 for the RADIUS ports...


Thanks Again,
Matt