RADIUS-Netconf

RADIUS

Resources Summary

YANG Path	get/get-config	edit-config	rpc
/radius	Y	merge, replace, create, delete	—
/radius/global	Y	merge, replace, create, delete	—
/radius/servers/{ipaddress}	Y	merge, replace, create, delete	—

Examples

This chapter provides examples of how to configure and manage RADIUS on AsterNOS devices using NETCONF.

NOTE

RADIUS should be used together with AAA configuration. Please refer to AAA for AAA configuration examples.

RADIUS Vendor Attributes

For supporting RADIUS authorization with vendor-specific attributes, AsterNOS provides a set of predefined vendor attributes.

The following table lists the supported vendor attributes:

VENDOR        Asterfusion  56928
BEGIN-VENDOR  Asterfusion
ATTRIBUTE     ASTER-Terminal-Type 1 string
ATTRIBUTE     ASTER-Terminal-Vendor 2 string
ATTRIBUTE     ASTER-Privilege 3 integer
ATTRIBUTE     ASTER-Service 4 string
ATTRIBUTE     ASTER-Command 5 string
ATTRIBUTE     ASTER-Argument 6 string
ATTRIBUTE     ASTER-Error 7 string
END-VENDOR    Asterfusion

If user want to assign vendor attributes to a user, please configure corresponding attributes on radius server.

• ASTER-Privilege is used to assign privilege level to a user. The value range is from 0 to 15, where 0 is the lowest privilege level and 15 is the highest privilege level.
• ASTER-Service is used to assign service level command permission to a user. The value will be provided by other documents.
• ASTER-Command is used to assign cmd level command permission to a user.

Example of configuring vendor attributes on freeradius server users file:

bob0   Cleartext-Password := "hello"
    Service-Type = NAS-Prompt-User,
    ASTER-Privilege = 0,
    ASTER-Service = "interface,l2",
    ASTER-Command = "(configure|exit|(^interface.*))"

Configure RADIUS Global Attributes

Request example to configure RADIUS global attributes via edit-config

<config><top>
    <radius>
        <global>
            <timeout>30</timeout>
            <retransmit>3</retransmit>
            <auth-type>chap</auth-type>
            <shared-secret>123456</shared-secret>
            <src-ip>192.168.1.1</src-ip>
            <nas-ip>10.0.0.1</nas-ip>
        </global>
    </radius>
</top></config>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:ebfa3243-1eef-4fb8-a002-5f8b06596324">
    <ok/>
</rpc-reply>

Add RADIUS Server

Request example to add RADIUS server via edit-config

<config><top>
    <radius>
        <servers operation="create">
            <server>
                <ipaddress>192.168.1.2</ipaddress>
                <auth-port>1812</auth-port>
                <auth-type>pap</auth-type>
                <timeout>30</timeout>
            </server>
            <server>
                <ipaddress>192.168.1.3</ipaddress>
                <auth-port>1813</auth-port>
                <auth-type>chap</auth-type>
                <timeout>50</timeout>
            </server>
        </servers>
    </radius>
</top></config>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:e5bdc8c8-b73c-4987-9907-0ae6f1229d81">
    <ok/>
</rpc-reply>

Get RADIUS Configuration

Request example to get RADIUS configuration via get-config

<filter type="subtree">
  <top>
    <radius/>
  </top>
</filter>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:d497411c-967b-482b-8637-766faf82f727">
    <data>
        <top>
            <radius xmlns="http://asterfusion.com/ns/yang/asternos-radius">
                <global>
                    <shared-secret>123456</shared-secret>
                    <auth-type>chap</auth-type>
                    <src-ip>192.168.1.1</src-ip>
                    <nas-ip>10.0.0.1</nas-ip>
                    <timeout>30</timeout>
                    <retransmit>3</retransmit>
                </global>
                <servers>
                    <server>
                        <ipaddress>192.168.1.2</ipaddress>
                        <auth-port>1812</auth-port>
                        <auth-type>pap</auth-type>
                        <timeout>30</timeout>
                    </server>
                    <server>
                        <ipaddress>192.168.1.3</ipaddress>
                        <auth-port>1813</auth-port>
                        <auth-type>chap</auth-type>
                        <timeout>50</timeout>
                    </server>
                </servers>
            </radius>
        </top>
    </data>
</rpc-reply>

Request example to get single radius server configuration

<filter type="subtree">
  <top>
    <radius>
        <servers>
            <server>
                <ipaddress>192.168.1.2</ipaddress>
            </server>
        </servers>
    </radius>
  </top>
</filter>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:e5f7621e-ec07-44b2-8c16-8a82878381a2">
    <data>
        <top>
            <radius xmlns="http://asterfusion.com/ns/yang/asternos-radius">
                <servers>
                    <server>
                        <ipaddress>192.168.1.2</ipaddress>
                        <auth-port>1812</auth-port>
                        <auth-type>pap</auth-type>
                        <timeout>30</timeout>
                    </server>
                </servers>
            </radius>
        </top>
    </data>
</rpc-reply>

Delete RADIUS Server

Request example to delete single RADIUS server via edit-config

<config><top>
    <radius>
        <servers>
            <server operation="delete">
                <ipaddress>192.168.1.2</ipaddress>
            </server>
        </servers>
    </radius>
</top></config>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:f81dc57e-98e9-40fd-a405-b1ec2c381d14">
    <ok/>
</rpc-reply>

Request example to delete all RADIUS servers via edit-config

<config><top>
    <radius>
        <servers operation="delete"/>
    </radius>
</top></config>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:0d022129-79d2-4f46-9f20-5f4f69cd31a5">
    <ok/>
</rpc-reply>

Properties Descriptions

Radius configuration

Tree Diagram

module: asternos-radius
  +--rw radius
     +--rw global
     |  +--rw shared-secret?   string
     |  +--rw auth-type?       auth-type-enumeration
     |  +--rw src-ip?          inet:ip-address-no-zone
     |  +--rw nas-ip?          inet:ip-address-no-zone
     |  +--rw timeout?         uint8
     |  +--rw retransmit?      uint8
     +--rw servers
        +--rw server* [ipaddress]
           +--rw ipaddress        inet:ip-address-no-zone
           +--rw auth-port?       inet:port-number
           +--rw shared-secret?   string
           +--rw auth-type?       auth-type-enumeration
           +--rw priority?        uint8
           +--rw timeout?         uint16
           +--rw retransmit?      uint8
           +--rw vrf?             string
           +--rw src-intf?        union

Table of Properties

Name	Required	Type/Range	Description
radius	M		Path-only node, has no configurable value. Radius configuration
global	M		Path-only node, has no configurable value. Global radius configuration
shared-secret	O	None	RADIUS global shared secret (Valid chars are ASCII printable except SPACE, ”#”, and ”,“)
auth-type	O	”pap" "chap”	RADIUS global method used for authenticating the comm. mesg. Default value: pap
src-ip	O	inet:ip-address-no-zone	source IP address (IPv4 or IPv6) for the outgoing RADIUS pkts.
nas-ip	O	inet:ip-address-no-zone	NAS-IP
timeout	O	1..60	Radius timeout in seconds Default value: 5
retransmit	O	0..10	Default value: 3
servers	M		Path-only node, has no configurable value.
server	M		Path-only node, has no configurable value.
ipaddress	O	inet:ip-address-no-zone	RADIUS server’s Domain name or IP address (IPv4 or IPv6)
auth-port	O	inet:port-number	RADIUS authentication port number. Default value: 1812
shared-secret	O	None	RADIUS servers shared secret (Valid chars are ASCII printable except SPACE, ”#”, and ”,“)
auth-type	O	”pap" "chap”	RADIUS server’s method used for authenticating the comm. mesg. Default value: pap
priority	O	1..64	RADIUS server’s priority
timeout	O	1..60	Default value: 5
retransmit	O	0..10	Default value: 3
vrf	O	None	VRF name
src-intf	O	Ethernet name

Global radius configuration

Tree Diagram

module: asternos-radius
  +--rw radius
     +--rw global
        +--rw shared-secret?   string
        +--rw auth-type?       auth-type-enumeration
        +--rw src-ip?          inet:ip-address-no-zone
        +--rw nas-ip?          inet:ip-address-no-zone
        +--rw timeout?         uint8
        +--rw retransmit?      uint8

Table of Properties

Name	Required	Type/Range	Description
global	M		Path-only node, has no configurable value. Global radius configuration
shared-secret	O	None	RADIUS global shared secret (Valid chars are ASCII printable except SPACE, ”#”, and ”,“)
auth-type	O	”pap" "chap”	RADIUS global method used for authenticating the comm. mesg. Default value: pap
src-ip	O	inet:ip-address-no-zone	source IP address (IPv4 or IPv6) for the outgoing RADIUS pkts.
nas-ip	O	inet:ip-address-no-zone	NAS-IP
timeout	O	1..60	Radius timeout in seconds Default value: 5
retransmit	O	0..10	Default value: 3

Servers

Tree Diagram

module: asternos-radius
  +--rw radius
     +--rw servers
        +--rw server* [ipaddress]
           +--rw ipaddress        inet:ip-address-no-zone
           +--rw auth-port?       inet:port-number
           +--rw shared-secret?   string
           +--rw auth-type?       auth-type-enumeration
           +--rw priority?        uint8
           +--rw timeout?         uint16
           +--rw retransmit?      uint8
           +--rw vrf?             string
           +--rw src-intf?        union

Table of Properties

Name	Required	Type/Range	Description
servers	M		Path-only node, has no configurable value.
server	M		Path-only node, has no configurable value.
ipaddress	O	inet:ip-address-no-zone	RADIUS server’s Domain name or IP address (IPv4 or IPv6)
auth-port	O	inet:port-number	RADIUS authentication port number. Default value: 1812
shared-secret	O	None	RADIUS servers shared secret (Valid chars are ASCII printable except SPACE, ”#”, and ”,“)
auth-type	O	”pap" "chap”	RADIUS server’s method used for authenticating the comm. mesg. Default value: pap
priority	O	1..64	RADIUS server’s priority
timeout	O	1..60	Default value: 5
retransmit	O	0..10	Default value: 3
vrf	O	None	VRF name
src-intf	O	Ethernet name