Courseiva
AAAGlobal Config

radius server [name]

Configures a RADIUS server entry with its IP address and authentication/accounting parameters for AAA services.

Definition: radius server [name] is a Cisco IOS global config command. Configures a RADIUS server entry with its IP address and authentication/accounting parameters for AAA services.

Overview

The 'radius server [name]' command is used in Cisco IOS global configuration mode to define a RADIUS server entry and enter RADIUS server configuration submode. This command is fundamental for implementing AAA (Authentication, Authorization, and Accounting) services using RADIUS protocol. RADIUS (Remote Authentication Dial-In User Service) is a client-server protocol that enables network devices (NAS - Network Access Server) to communicate with a central RADIUS server for user authentication, authorization, and accounting.

The command creates a named RADIUS server entry, allowing you to specify the server's IP address, authentication and accounting ports, shared secret key, and other parameters such as timeout, retransmit count, and source interface. This is critical for securing network access for VPN users, wireless clients, switch port authentication (802.1X), and administrative access to network devices. Without proper RADIUS configuration, network devices rely on local authentication, which is not scalable for large enterprises.

The 'radius server' command replaces the older 'radius-server host' command in newer IOS versions, offering more granular control and better integration with AAA server groups. When to use this command vs alternatives: For TACACS+ (Cisco proprietary), use 'tacacs server' command; for local authentication, use 'username' commands; for LDAP, use 'ldap server'. The 'radius server' command is preferred when you need to configure multiple RADIUS servers with different parameters or when using advanced features like dynamic authorization (CoA) or RADIUS load balancing.

In the broader workflow, after defining RADIUS servers, you create AAA authentication, authorization, and accounting method lists that reference these servers, then apply them to login, enable, or network access. Important IOS behavior: The command is available in IOS 15.0(1)M and later; in earlier versions, use 'radius-server host'. The command requires privilege level 15.

The running config will show the RADIUS server entry with its parameters. The command does not generate any immediate output; it enters submode where you configure the server details. The 'name' parameter is a local identifier and does not need to match the RADIUS server's hostname.

If you omit the 'name', you will get an error. The submode allows configuration of IPv4 or IPv6 addresses, but not both for the same server entry. The shared secret is stored in the running config as encrypted text (type 7 or type 8/9 depending on IOS version).

The command also supports FQDN for the server address, but it is recommended to use IP addresses for reliability. Understanding this command is essential for CCNA and CCNP candidates as RADIUS is widely deployed in enterprise networks for centralized authentication and accounting.

Syntax·Global Config
radius server [name]

When to Use This Command

  • Define a RADIUS server for authenticating remote VPN users connecting via IPsec.
  • Configure a RADIUS server for 802.1X port-based authentication on switch ports.
  • Set up a RADIUS server for administrative login authentication (e.g., SSH/Telnet).
  • Add multiple RADIUS servers for redundancy in a large enterprise network.

Parameters

ParameterSyntaxDescription
nameWORD (1-31 characters)Specifies the name of the RADIUS server entry. This is a local identifier used to reference the server in other commands (e.g., 'aaa group server radius'). The name must be unique and can contain alphanumeric characters and hyphens. Common mistake: using spaces or special characters that are not allowed.

Command Examples

Basic RADIUS server configuration with key and timeout

radius server MYRADIUS address ipv4 192.168.1.100 auth-port 1812 acct-port 1813 key cisco123 timeout 10 retransmit 3 exit
Router(config)# radius server MYRADIUS
Router(config-radius-server)# address ipv4 192.168.1.100 auth-port 1812 acct-port 1813
Router(config-radius-server)# key cisco123
Router(config-radius-server)# timeout 10
Router(config-radius-server)# retransmit 3
Router(config-radius-server)# exit
Router(config)#

The command enters RADIUS server configuration mode for server named 'MYRADIUS'. The address command sets the IPv4 address and UDP ports for authentication (1812) and accounting (1813). The key command sets the shared secret. Timeout sets seconds to wait for reply, retransmit sets number of retries.

RADIUS server with dead-criteria and automation testing

radius server BACKUP_RADIUS address ipv4 10.0.0.1 auth-port 1645 acct-port 1646 key secretkey dead-criteria tries 5 time 30 automate-tester username testuser probe-on exit
Router(config)# radius server BACKUP_RADIUS
Router(config-radius-server)# address ipv4 10.0.0.1 auth-port 1645 acct-port 1646
Router(config-radius-server)# key secretkey
Router(config-radius-server)# dead-criteria tries 5 time 30
Router(config-radius-server)# automate-tester username testuser probe-on
Router(config-radius-server)# exit
Router(config)#

This example configures a backup RADIUS server with non-default ports (1645/1646). The dead-criteria command marks the server as dead after 5 failed attempts within 30 seconds. The automate-tester command enables periodic probing using the username 'testuser' to detect server recovery.

Understanding the Output

The radius server command does not produce a direct output; it enters a subconfiguration mode. The output shown is the CLI prompt changes indicating you are in RADIUS server configuration mode. To verify the configuration, use 'show running-config | section radius server' or 'show radius server'.

The 'show radius server' output lists all configured servers with their IP addresses, ports, keys (shown as asterisks), timeout, retransmit, dead criteria, and status (alive/dead). Key fields: Server Name, IP address, Auth Port, Acct Port, Timeout, Retransmit, Dead Time, Status. A good status is 'alive'; 'dead' indicates the server is not responding.

Watch for mismatched keys or unreachable IPs.

Configuration Scenarios

Configure a RADIUS server for wireless LAN authentication

A company wants to authenticate wireless users against a central RADIUS server (192.168.1.10) using WPA2-Enterprise. The RADIUS server uses default ports (1812 for authentication, 1813 for accounting) and a shared secret 'cisco123'.

Topology

WLC (Gi0/0)---192.168.1.0/24---RADIUS Server (192.168.1.10)

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Create a RADIUS server entry named 'WLAN-RADIUS': radius server WLAN-RADIUS
  3. 3.Step 3: Specify the RADIUS server IP address: address ipv4 192.168.1.10 auth-port 1812 acct-port 1813
  4. 4.Step 4: Set the shared secret: key cisco123
  5. 5.Step 5: (Optional) Configure timeout and retransmit: timeout 5, retransmit 3
  6. 6.Step 6: Exit RADIUS server submode: exit
  7. 7.Step 7: Create an AAA authentication method list for login: aaa authentication login default group radius local
  8. 8.Step 8: Create an AAA authorization method list for network: aaa authorization network default group radius
  9. 9.Step 9: Create an AAA accounting method list for exec: aaa accounting exec default start-stop group radius
Configuration
! RADIUS server configuration
radius server WLAN-RADIUS
 address ipv4 192.168.1.10 auth-port 1812 acct-port 1813
 key cisco123
 timeout 5
 retransmit 3
!
! AAA method lists
aaa new-model
aaa authentication login default group radius local
aaa authorization network default group radius
aaa accounting exec default start-stop group radius

Verify: Use 'show radius server' to verify the server is configured. Expected output shows the server name, IP address, ports, and key (encrypted). Use 'test aaa group radius username password' to test authentication.

Watch out: Ensure that the RADIUS server's shared secret matches exactly. Also, the 'aaa new-model' command must be enabled for AAA to work. If the RADIUS server is unreachable, authentication will fall back to local if configured.

Configure multiple RADIUS servers for redundancy

A network administrator needs to configure two RADIUS servers (primary: 10.0.0.1, secondary: 10.0.0.2) for device administration authentication. The primary server uses port 1645, secondary uses default port 1812. Both use the same key 'adminkey'.

Topology

Router (Gi0/0)---10.0.0.0/24---Primary RADIUS (10.0.0.1) & Secondary RADIUS (10.0.0.2)

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Create first RADIUS server entry: radius server PRIMARY
  3. 3.Step 3: Configure primary server: address ipv4 10.0.0.1 auth-port 1645 acct-port 1646
  4. 4.Step 4: Set key: key adminkey
  5. 5.Step 5: Exit: exit
  6. 6.Step 6: Create second RADIUS server entry: radius server SECONDARY
  7. 7.Step 7: Configure secondary server: address ipv4 10.0.0.2 auth-port 1812 acct-port 1813
  8. 8.Step 8: Set key: key adminkey
  9. 9.Step 9: Exit: exit
  10. 10.Step 10: Create a RADIUS server group: aaa group server radius ADMIN-GROUP
  11. 11.Step 11: Add servers to group: server name PRIMARY, server name SECONDARY
  12. 12.Step 12: Exit: exit
  13. 13.Step 13: Apply group to authentication: aaa authentication login default group ADMIN-GROUP local
Configuration
! RADIUS server entries
radius server PRIMARY
 address ipv4 10.0.0.1 auth-port 1645 acct-port 1646
 key adminkey
!
radius server SECONDARY
 address ipv4 10.0.0.2 auth-port 1812 acct-port 1813
 key adminkey
!
! Server group
aaa group server radius ADMIN-GROUP
 server name PRIMARY
 server name SECONDARY
!
! AAA method list
aaa new-model
aaa authentication login default group ADMIN-GROUP local

Verify: Use 'show radius server' to see both servers. Use 'show aaa servers' to see server status. Use 'debug radius authentication' to monitor authentication attempts. If primary fails, secondary should be tried.

Watch out: The order of servers in the group matters; the first server is primary. Ensure that the RADIUS server ports are correctly configured; some legacy servers use 1645/1646. Also, the 'server name' command references the name given in 'radius server' command, not the IP address.

Troubleshooting with This Command

When troubleshooting RADIUS authentication issues, the 'radius server' command itself does not provide direct diagnostic output, but it is the foundation for verifying server configuration. The primary troubleshooting commands are 'show radius server', 'show aaa servers', 'debug radius authentication', and 'debug radius accounting'. Healthy output from 'show radius server' shows each configured server with its IP address, ports, and key (encrypted).

Problem indicators include: missing server entries, incorrect IP addresses, wrong ports, or 'key not set' message. The 'show aaa servers' command shows the status of each server (alive/dead) and statistics like number of transactions and failures. If a server is marked as 'dead', it means the router has marked it as unreachable after repeated timeouts.

Common symptoms this command helps diagnose include: users unable to authenticate (check if server is configured and alive), authentication timeouts (check timeout and retransmit values), and accounting failures (check acct-port). Step-by-step diagnostic flow: 1) Verify RADIUS server configuration with 'show radius server'. Ensure the IP address and ports are correct. 2) Check server reachability with 'ping' from the router to the RADIUS server. 3) Use 'test aaa group radius username password' to simulate authentication. 4) Enable 'debug radius authentication' and attempt authentication; look for 'Access-Request' sent and 'Access-Accept' or 'Access-Reject' received.

If no response, check firewall rules and shared secret. 5) Check 'show aaa servers' to see if the server is marked dead; if so, clear the dead status with 'clear aaa servers' or adjust dead criteria. 6) Verify that the AAA method lists reference the correct server group. Correlate with 'show running-config | section aaa' to see method lists. Also, check that 'aaa new-model' is enabled.

If using 802.1X, verify the switch port configuration. The 'debug radius' commands can be CPU-intensive; use with caution in production. For accounting issues, use 'debug radius accounting'.

Remember that RADIUS uses UDP, so packet loss can cause intermittent issues. Use 'show ip traffic' to see UDP statistics. If the RADIUS server is not responding, check the router's source interface; use the 'source' command in RADIUS server submode to set a specific interface.

Finally, ensure that the RADIUS server's shared secret matches exactly; case-sensitive. The 'key' command in the RADIUS server submode stores the key in encrypted form; you cannot retrieve the plaintext key from the router.

CCNA Exam Tips

1.

Remember that the default authentication port is 1812 and accounting port is 1813; the exam may test non-standard ports like 1645/1646.

2.

The 'key' command is case-sensitive and must match the RADIUS server's shared secret.

3.

You can configure multiple RADIUS servers; the order in the configuration determines the priority (first is primary).

4.

The 'automate-tester' feature is used to proactively test server availability; know its parameters.

Common Mistakes

Forgetting to specify the key; AAA authentication will fail silently.

Using the wrong port numbers (e.g., using 1645 for auth but server expects 1812).

Not configuring a timeout and retransmit values, causing slow failover when server is down.

radius server [name] vs aaa new-model

Both commands are part of AAA configuration on Cisco IOS devices, but they operate at different levels: 'aaa new-model' enables the AAA framework globally, while 'radius server [name]' defines a specific RADIUS server instance. They are often confused because both are required for RADIUS-based authentication and appear in similar configuration contexts.

Aspectradius server [name]aaa new-model
ScopeSpecific to a single RADIUS server entryGlobal AAA framework for all authentication methods
Configuration modeGlobal config then server config (radius server <name> enters server submode)Global configuration mode only
DependencyRequires 'aaa new-model' to be activeNo prerequisite; must be configured before other AAA commands
PersistencePersists in running-config and startup-configPersists in running-config and startup-config
PrecedenceMultiple servers can be defined; priority determined by order or weightSingle global enable; all AAA methods depend on it
Typical useDefine RADIUS server IP, key, and port for authentication/accountingEnable AAA services before configuring any AAA method lists or server groups

Use radius server [name] when you need to specify the IP address, shared secret, and port settings for a particular RADIUS server that will handle AAA requests.

Use aaa new-model when you intend to configure any AAA security services (RADIUS, TACACS+, local authentication) on the device, as it is the foundational command that activates the AAA subsystem.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches, ISR 4000 series), the 'radius server' command syntax is identical to classic IOS. However, IOS-XE supports additional parameters like 'automate-tester' for proactive server monitoring. The output of 'show radius server' may include additional fields like 'Deadtime' and 'Automate-tester' status.

In NX-OS (e.g., Nexus switches), the equivalent command is 'radius-server host' with a different submode. For example: 'radius-server host 192.168.1.10 key cisco123'. NX-OS does not use the 'radius server [name]' command; instead, you configure hosts directly under 'radius-server host'.

Also, NX-OS uses 'aaa group server radius' to group servers. In ASA (Adaptive Security Appliance), the command is 'radius-server host' in global config mode, similar to older IOS. For example: 'radius-server host 10.0.0.1 key cisco123 authentication-port 1645 accounting-port 1646'.

ASA does not support named RADIUS server entries. In IOS-XR (e.g., ASR 9000), the command is 'radius server' but the submode syntax differs; for example, 'address ipv4 10.0.0.1' and 'key' are configured under 'radius server' submode, but the overall structure is similar to IOS. However, IOS-XR uses 'aaa authentication' commands differently.

For IOS versions prior to 15.0(1)M, the 'radius-server host' command is used instead of 'radius server'. The 'radius server' command was introduced to support multiple server entries with different keys and ports. In IOS 15.x and later, both commands may coexist, but 'radius server' is preferred.

In IOS 12.x, only 'radius-server host' is available. When migrating configurations, convert 'radius-server host' entries to 'radius server' entries for consistency. Also, note that the 'key' command in 'radius server' submode supports type 8/9 encryption in newer IOS versions for enhanced security.

Always check the specific platform documentation for exact syntax and capabilities.

Related Commands

aaa authentication login default group radius local

Configures AAA authentication for login using a RADIUS server group as the primary method, falling back to local authentication if the RADIUS server is unreachable.

aaa new-model

Enables AAA (Authentication, Authorization, and Accounting) security services on a Cisco device, required before configuring any AAA commands.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions