How to have a Radius server encrypted key in run-conf

[guillaume.malartre]

Hi,

I want to add a couple of radius server with their keys. But :

when I'm about to configure the key I can or add an encrypted key OR enter a plaintext key that will remains unencrypted in the show run.

How can I add the server key in plaintext, but have it in encrypted format in the show run ?

Here the choices I have :

#radius server monserver

#key ?
0 Specifies an UNENCRYPTED key will follow
6 Specifies ENCRYPTED key will follow
7 Specifies HIDDEN key will follow
LINE The UNCRYPTED (cleartext) shared key

the options 6 and 7 require to enter the key in encrypted format.

the option 0 and "LINE" accept my key in plaintext format but does not encrypt it in the show run as a command like :

#username cisco password...

thanks for your help

[Rob Ingram · Accepted solution]

@guillaume.malartre 

use Type 6 passwords

https://community.cisco.com/t5/networking-documents/configuring-type-6-passwords-in-ios-xe/ta-p/4438495

https://community.cisco.com/t5/networking-documents/understanding-the-differences-between-the-cisco-password-secret/ta-p/3163238

[Flavio Miranda · Accepted solution]

As far as I know, you only need the command "enable secret" and "service password-encryption" on IOS devices. 

[guillaume.malartre]

So I configure my Radius server key in plaintext and then I use the command service password-encryption to encrypt it in the conf ?