address ipv4 [ip] auth-port 1812
Configures the IPv4 address and authentication port for a RADIUS server, used to specify the server that handles AAA authentication requests.
Definition: address ipv4 [ip] auth-port 1812 is a Cisco IOS radius config command. Configures the IPv4 address and authentication port for a RADIUS server, used to specify the server that handles AAA authentication requests.
Overview
The `address ipv4 [ip] auth-port 1812` command is used in RADIUS server configuration mode to specify the IPv4 address and authentication port of a RADIUS server. This command is critical for enabling AAA (Authentication, Authorization, and Accounting) services, as it defines which RADIUS server will handle authentication requests. In enterprise networks, RADIUS is commonly used for centralized user authentication (e.g., for network device access, VPN, or wireless).
Without this command, the router or switch cannot communicate with the RADIUS server, and AAA authentication will fail. The command is typically used after entering RADIUS server configuration mode via `radius server <name>`. The default authentication port is UDP 1812, but this command allows you to change it if your RADIUS server uses a non-standard port.
This command is part of the broader AAA configuration workflow: first define the RADIUS server with its IP and key, then apply it to login, enable, or other authentication methods. It is important to note that the RADIUS server must be reachable from the device, and the shared secret must match. Common mistakes include using the wrong port (e.g., 1645, which is an older standard) or forgetting to specify the port when the server uses a non-default port.
This command does not affect the running configuration until you exit configuration mode, and it requires privileged EXEC access (enable mode) to configure.
address ipv4 [ip] auth-port 1812When to Use This Command
- Setting up a primary RADIUS server for network device authentication in a corporate network.
- Configuring a backup RADIUS server with a different port for redundancy.
- Integrating with a third-party RADIUS server like Cisco ISE or FreeRADIUS for centralized AAA.
- Changing the default authentication port (1812) to a custom port for security or compatibility reasons.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| ip | A.B.C.D | The IPv4 address of the RADIUS server. This must be a valid unicast address, typically in a private range like 10.0.0.0/8 or 192.168.0.0/16. Common mistakes include using a broadcast or multicast address, or an address that is not reachable from the device. |
| auth-port | <1-65535> | The UDP port number for authentication requests. The default is 1812. If omitted, the default port is used. Common mistakes include using port 1645 (an older standard) or a port already used by another service. Ensure the RADIUS server listens on this port. |
Command Examples
Basic RADIUS server configuration with default port
address ipv4 192.168.1.100 auth-port 1812No output is generated for this configuration command. The command sets the RADIUS server IPv4 address to 192.168.1.100 and the authentication UDP port to 1812 (default).
Configuring a RADIUS server with custom authentication port
address ipv4 10.0.0.5 auth-port 1645This command sets the RADIUS server IPv4 address to 10.0.0.5 and the authentication port to 1645, which is an alternative standard port. No output is displayed upon successful configuration.
Understanding the Output
This command does not produce any output when executed. It is a configuration command that modifies the RADIUS server configuration in the running configuration. To verify the configuration, use 'show running-config | section radius' or 'show radius server'.
The output of 'show radius server' displays the configured servers, their IP addresses, ports, and status (e.g., dead or alive). A good status shows 'current state: alive' with low response times; a bad status shows 'current state: dead' or high timeouts. Watch for incorrect port numbers or unreachable IP addresses.
Configuration Scenarios
Configure a RADIUS server for network device authentication
A network administrator wants to centralize authentication for SSH access to routers and switches using a RADIUS server at 10.1.1.100. The server uses the default authentication port 1812.
Topology
R1(Gi0/0)---192.168.1.0/24---(Gi0/0)RADIUS-Server(10.1.1.100)Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Create a RADIUS server configuration: radius server MYRADIUS
- 3.Step 3: Specify the IPv4 address and authentication port: address ipv4 10.1.1.100 auth-port 1812
- 4.Step 4: Set the shared secret: key mysecretkey
- 5.Step 5: Exit RADIUS server configuration: exit
- 6.Step 6: Apply RADIUS authentication for login: aaa new-model
- 7.Step 7: Define authentication list: aaa authentication login default group radius local
- 8.Step 8: Verify configuration: show running-config | section radius
! radius server MYRADIUS address ipv4 10.1.1.100 auth-port 1812 key mysecretkey ! aaa new-model aaa authentication login default group radius local !
Verify: Use `show running-config | section radius` to verify the RADIUS server configuration. Expected output includes the server address and port. Also use `test aaa group radius login <username> password <password>` to test authentication.
Watch out: Forgetting to enable AAA with `aaa new-model` will cause the RADIUS configuration to be ignored. Also, ensure the RADIUS server is reachable and the shared secret matches.
Configure a RADIUS server with a non-default authentication port
A company uses a RADIUS server at 192.168.10.50 that listens on UDP port 18120 for authentication due to security policies. The administrator needs to configure the device to use this non-standard port.
Topology
SW1(Vlan10)---192.168.10.0/24---(eth0)RADIUS-Server(192.168.10.50)Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Create a RADIUS server configuration: radius server CUSTOMRADIUS
- 3.Step 3: Specify the IPv4 address and custom authentication port: address ipv4 192.168.10.50 auth-port 18120
- 4.Step 4: Set the shared secret: key securekey123
- 5.Step 5: Exit RADIUS server configuration: exit
- 6.Step 6: Apply RADIUS authentication for enable: aaa authentication enable default group radius
- 7.Step 7: Verify configuration: show radius server
! radius server CUSTOMRADIUS address ipv4 192.168.10.50 auth-port 18120 key securekey123 ! aaa authentication enable default group radius !
Verify: Use `show radius server` to see the configured servers and their ports. Expected output shows server 192.168.10.50 with auth-port 18120. Also use `debug radius authentication` to monitor authentication attempts.
Watch out: If the RADIUS server uses a non-default port, you must specify it; otherwise, the device will attempt to use port 1812 and fail. Also, ensure no firewall blocks the custom port.
Troubleshooting with This Command
When troubleshooting RADIUS authentication issues, the `address ipv4` command is often the first place to check. Healthy output from `show running-config | section radius` should display the correct IP address and port. If authentication fails, verify the RADIUS server is reachable via ping.
Use `debug radius authentication` to see detailed transaction logs; look for 'Access-Request' sent to the correct IP and port. Common symptoms include 'Authentication failed' messages, which may indicate a mismatch in shared secret or incorrect server address. Focus on the 'Server' field in debug output to confirm the device is contacting the right server.
If the port is wrong, the device will send packets to a closed port, resulting in timeouts. A step-by-step diagnostic flow: 1) Check `show running-config | section radius` for correct IP and port. 2) Ping the RADIUS server from the device. 3) Use `test aaa group radius <username> <password>` to simulate authentication. 4) Enable `debug radius authentication` and attempt login; look for 'Access-Request' and 'Access-Accept' or 'Access-Reject'. 5) If no response, check for firewall rules or incorrect port. Correlate with `show ip interface brief` to ensure the source interface has connectivity.
Also, verify the RADIUS server logs for incoming requests. The `address ipv4` command is essential for directing traffic; if the IP is wrong, all authentication attempts will fail silently.
CCNA Exam Tips
Remember that the default RADIUS authentication port is UDP 1812, but some legacy systems use 1645.
The 'address ipv4' command is used in RADIUS server configuration mode, not global config.
CCNA may test that RADIUS uses UDP, while TACACS+ uses TCP.
You must configure a key (shared secret) using the 'key' command for the RADIUS server to work.
Common Mistakes
Forgetting to specify the authentication port, which defaults to 1812 but may be incorrect if the server uses a different port.
Using the wrong IP address or a reachable but incorrect server, causing authentication failures.
Not configuring a shared secret key, leading to authentication rejections.
address ipv4 [ip] auth-port 1812 vs key [shared-secret]
Both commands are used within RADIUS server configuration mode to define the server's parameters. They are often considered together because a fully functional RADIUS server requires both an IP address/port and a shared secret key. Misconfiguration of either can cause authentication failures.
| Aspect | address ipv4 [ip] auth-port 1812 | key [shared-secret] |
|---|---|---|
| Scope | Defines server IP and authentication port | Defines shared secret key for encryption |
| Configuration mode | RADIUS server configuration sub-mode | Same RADIUS server configuration sub-mode |
| Persistence | Saved in running-config as radius-server host entry | Saved in running-config as part of same radius-server host entry |
| Precedence | No precedence impact; required for server reachability | Must match exactly on server and client; no precedence ordering |
| Typical use | Configured once per RADIUS server | Configured once per RADIUS server with matching secret on server |
Use address ipv4 [ip] auth-port 1812 when specifying the IPv4 address and UDP authentication port (default 1812) of the RADIUS server that will handle AAA authentication requests.
Use key [shared-secret] when setting the pre-shared secret that the Cisco device and the RADIUS server will use to encrypt and authenticate RADIUS packets.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the syntax is identical: `address ipv4 <ip> auth-port <port>`. However, IOS-XE may support additional parameters like `acct-port` for accounting. In NX-OS (e.g., Nexus switches), the equivalent command is `radius-server host <ip> auth-port <port>`, used in global configuration mode instead of a separate server configuration.
For example: `radius-server host 10.1.1.100 auth-port 1812 key mykey`. NX-OS does not have a `radius server` sub-mode. On ASA firewalls, the command is `radius-server host <ip> auth-port <port> key <key>` in global configuration mode.
In IOS-XR, the command is `radius server <name>` then `address ipv4 <ip> auth-port <port>`, similar to classic IOS but with slight differences in the key configuration. Between IOS versions, the command has remained consistent since 12.x, but older versions (12.x) may require the `radius-server host` command instead of the sub-mode. For example, in IOS 12.4, you would use `radius-server host 10.1.1.100 auth-port 1812`.
The sub-mode was introduced in later 15.x versions. Always check the specific IOS version documentation.
Related Commands
aaa authentication login default group radius local
Configures AAA authentication for login using a RADIUS server group as the primary method, falling back to local authentication if the RADIUS server is unreachable.
aaa new-model
Enables AAA (Authentication, Authorization, and Accounting) security services on a Cisco device, required before configuring any AAA commands.
key [shared-secret]
Configures the shared secret key used for RADIUS authentication and accounting between the Cisco device and the RADIUS server.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions