Courseiva
AAARADIUS Config

key [shared-secret]

Configures the shared secret key used for RADIUS authentication and accounting between the Cisco device and the RADIUS server.

Definition: key [shared-secret] is a Cisco IOS radius config command. Configures the shared secret key used for RADIUS authentication and accounting between the Cisco device and the RADIUS server.

Overview

The 'key [shared-secret]' command, used in RADIUS configuration mode on Cisco IOS devices, defines the shared secret key that authenticates communication between the router or switch and a RADIUS server. This key is a pre-shared string (up to 128 characters) that both the Cisco device and the RADIUS server must know; it is used to encrypt and validate RADIUS packets (Access-Request, Access-Accept, Accounting-Request, etc.) via MD5 hashing. Without a correctly matching key, RADIUS authentication and accounting will fail, potentially locking administrators out of the device or preventing user authentication.

This command is essential when deploying centralized AAA (Authentication, Authorization, Accounting) using RADIUS, which is common in enterprise networks for managing administrative access (e.g., SSH login) and user network access (e.g., 802.1X). The command is entered after configuring a RADIUS server group or individual server with 'radius server' and entering RADIUS configuration mode. It is an alternative to the older 'key' command under 'radius-server host' (global config), but the newer per-server configuration (under 'radius server') is preferred for granularity.

The command immediately updates the running configuration; no reload is needed. Privilege level 15 (enable) is required to enter RADIUS configuration mode. The key is stored in the running config as a type 7 (Cisco proprietary) encrypted string by default, but can be stored as type 6 (AES) if 'key config-key' is configured.

This command is part of the AAA workflow: first define the RADIUS server, then apply it to authentication/accounting methods. It is crucial for security; a weak or mismatched key is a common cause of AAA failures.

Syntax·RADIUS Config
key [shared-secret]

When to Use This Command

  • Setting up a shared secret for a new RADIUS server to enable AAA authentication for network device access.
  • Updating the shared secret when rotating keys for security compliance.
  • Configuring multiple RADIUS servers with different shared secrets for redundancy.
  • Troubleshooting RADIUS authentication failures by verifying the shared secret matches the server.

Parameters

ParameterSyntaxDescription
shared-secretWORD (1-128 characters)The shared secret key used for RADIUS authentication and encryption. It must match the key configured on the RADIUS server. Valid values are alphanumeric strings up to 128 characters; special characters are allowed but may require quoting. Common mistakes include using spaces (use quotes), exceeding length limits, or using weak keys that are easily guessed.

Command Examples

Configure shared secret for a RADIUS server

RADIUS(config)# key MySecretKey123

This command sets the shared secret to 'MySecretKey123' for the RADIUS server configuration context. No output is displayed upon successful configuration.

Verify the configured shared secret

RADIUS(config)# do show run | section radius-server
radius-server host 192.168.1.100 key MySecretKey123
radius-server host 192.168.1.101 key AnotherKey456

The output shows the running configuration for RADIUS servers. Each line includes the server IP and the shared secret (shown in plaintext if not encrypted). Verify that the key matches the RADIUS server's configuration.

Understanding the Output

The 'key' command itself does not produce output. To verify the configured shared secret, use 'show running-config | section radius-server' or 'show radius-server'. In the output, each RADIUS server entry displays the IP address and the shared secret key.

If the key is encrypted (e.g., 'key 7 0822455D0A16'), it means the service password-encryption is enabled. Ensure the key matches exactly what is configured on the RADIUS server; mismatched keys are a common cause of authentication failures. Also check that the key is not visible in plaintext in the configuration if security policies require encryption.

Configuration Scenarios

Configure RADIUS for Administrative Access

A network administrator wants to authenticate SSH logins to a Cisco router using a central RADIUS server at 192.168.1.100. The shared secret is 'Cisco123'.

Topology

Admin PC --- SSH --- Router(Gi0/0)---192.168.1.0/24---RADIUS Server (192.168.1.100)

Steps

  1. 1.Step 1: Enter global configuration mode: Router> enable, Router# configure terminal
  2. 2.Step 2: Define the RADIUS server and enter RADIUS config mode: Router(config)# radius server RADIUS-SERVER
  3. 3.Step 3: Set the server IP address: Router(config-radius-server)# address ipv4 192.168.1.100 auth-port 1812 acct-port 1813
  4. 4.Step 4: Configure the shared secret: Router(config-radius-server)# key Cisco123
  5. 5.Step 5: Exit RADIUS config mode: Router(config-radius-server)# exit
  6. 6.Step 6: Create an authentication method list for login: Router(config)# aaa authentication login default group radius local
  7. 7.Step 7: Apply to VTY lines: Router(config)# line vty 0 4, Router(config-line)# login authentication default
Configuration
! Full IOS config block
Router(config)# radius server RADIUS-SERVER
Router(config-radius-server)# address ipv4 192.168.1.100 auth-port 1812 acct-port 1813
Router(config-radius-server)# key Cisco123
Router(config-radius-server)# exit
Router(config)# aaa authentication login default group radius local
Router(config)# line vty 0 4
Router(config-line)# login authentication default

Verify: Command: show running-config | section radius server Expected output: radius server RADIUS-SERVER address ipv4 192.168.1.100 auth-port 1812 acct-port 1813 key 7 0822455D0A16 Also test with: test aaa group radius legacy admin Cisco123 (if test aaa is available)

Watch out: If the RADIUS server uses a different authentication port (e.g., 1645), you must specify it; otherwise, default 1812 is used. Also, ensure the key matches exactly on both sides.

Configure RADIUS for 802.1X Wireless Authentication

A company deploys 802.1X for wireless users. The Cisco WLC (or switch acting as authenticator) must communicate with a RADIUS server at 10.10.10.5 using secret 'SecureKey!2024'.

Topology

Wireless Client --- AP --- Switch(Gi0/1)---10.10.10.0/24---RADIUS Server (10.10.10.5)

Steps

  1. 1.Step 1: Enter global configuration mode: Switch> enable, Switch# configure terminal
  2. 2.Step 2: Define the RADIUS server: Switch(config)# radius server WLAN-RADIUS
  3. 3.Step 3: Set server IP: Switch(config-radius-server)# address ipv4 10.10.10.5 auth-port 1812 acct-port 1813
  4. 4.Step 4: Set the shared secret: Switch(config-radius-server)# key SecureKey!2024
  5. 5.Step 5: Exit: Switch(config-radius-server)# exit
  6. 6.Step 6: Enable AAA globally: Switch(config)# aaa new-model
  7. 7.Step 7: Configure authentication for dot1x: Switch(config)# aaa authentication dot1x default group radius
  8. 8.Step 8: Enable 802.1X on interface: Switch(config)# interface GigabitEthernet0/1, Switch(config-if)# authentication port-control auto, Switch(config-if)# dot1x pae authenticator
Configuration
! Full IOS config block
Switch(config)# radius server WLAN-RADIUS
Switch(config-radius-server)# address ipv4 10.10.10.5 auth-port 1812 acct-port 1813
Switch(config-radius-server)# key SecureKey!2024
Switch(config-radius-server)# exit
Switch(config)# aaa new-model
Switch(config)# aaa authentication dot1x default group radius
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# authentication port-control auto
Switch(config-if)# dot1x pae authenticator

Verify: Command: show radius server-group all Expected output: Server group radius: has 1 servers Server: 10.10.10.5, port 1812/1813, key configured Also check: show authentication sessions interface Gi0/1

Watch out: If the RADIUS server uses a different shared secret for accounting, you must configure it separately using 'key' under the accounting server configuration. Also, ensure the switch has a route to the RADIUS server.

Troubleshooting with This Command

When troubleshooting RADIUS authentication failures, the 'key [shared-secret]' command itself is not directly debuggable, but its correct configuration is critical. Start by verifying the key is configured on both the Cisco device and the RADIUS server. Use 'show running-config | section radius server' to confirm the key is present (it will appear as encrypted text).

If the key is missing, re-enter it. Common symptoms include 'Authentication failed' or 'Access-Reject' messages. Use 'debug radius authentication' to see the RADIUS packets; look for 'Access-Request' and 'Access-Accept' or 'Access-Reject'.

If you see 'Access-Reject' with no further details, the key mismatch is likely. In the debug output, check the 'Authenticator' field; if it doesn't match, the key is wrong. Also, use 'test aaa group radius username password' (if available) to simulate authentication.

If the test fails with 'Invalid server response', check connectivity (ping) and port accessibility (telnet to 1812). Another useful command is 'show radius statistics' to see packet counters; if 'Access-Requests' are sent but no 'Access-Accepts' received, the server may be dropping packets due to key mismatch. Also, verify that the RADIUS server's client configuration includes the Cisco device's IP address and the same shared secret.

On the Cisco device, ensure the 'radius server' configuration uses the correct IP and ports. If using multiple RADIUS servers, each must have its own key. For accounting issues, check 'debug radius accounting'.

A step-by-step diagnostic flow: 1) Check physical connectivity and IP reachability to the RADIUS server. 2) Verify the key on both sides. 3) Enable debug radius and attempt authentication. 4) Analyze debug output for 'Access-Reject' or 'timeout'. 5) Check RADIUS server logs for authentication attempts. 6) If using VRF, ensure the RADIUS server is reachable via the correct VRF. Correlate 'show radius server-group' output with 'show ip route' to ensure the server is reachable.

CCNA Exam Tips

1.

CCNA exam tip: The 'key' command is configured in RADIUS config mode, not global config. You must first enter RADIUS server configuration mode using 'radius-server host <ip>'.

2.

CCNA exam tip: Shared secrets are case-sensitive and must match exactly on both the router and the RADIUS server.

3.

CCNA exam tip: Use 'service password-encryption' to encrypt the shared secret in the running configuration, but remember that type 7 encryption is weak and reversible.

4.

CCNA exam tip: For CCNA, know that RADIUS uses UDP ports 1812 for authentication and 1813 for accounting, but the shared secret is configured per server.

Common Mistakes

Mistake 1: Configuring the key in global configuration mode instead of RADIUS config mode, resulting in 'Invalid input detected' error.

Mistake 2: Using spaces or special characters in the shared secret without quotes, causing the router to interpret them as separate commands.

Mistake 3: Forgetting to apply the key to the correct RADIUS server when multiple servers are configured, leading to authentication failures on some servers.

key [shared-secret] vs aaa new-model

Both commands are essential for RADIUS-based AAA, but serve distinct functions. 'key [shared-secret]' sets the shared secret for a specific RADIUS server, while 'aaa new-model' globally enables the AAA framework. They are often confused because both are required together for RADIUS authentication to work.

Aspectkey [shared-secret]aaa new-model
ScopePer-server shared secret configurationGlobal AAA framework enablement
Configuration modeRADIUS Config submode (e.g., radius-server host ... key)Global configuration mode
PersistenceStored per RADIUS server definitionStored globally, affects all AAA services
PrecedenceRequired only after aaa new-model is activeMust be enabled before any AAA commands
Typical useSecuring communication between device and RADIUS serverActivating AAA feature set for authentication, authorization, and accounting
DependenciesRequires aaa new-model to be effectiveIndependent; no dependency on key command

Use key [shared-secret] when configuring a specific RADIUS server's authentication key after AAA has been enabled.

Use aaa new-model when you need to enable AAA security services on the device before any RADIUS or TACACS+ configuration.

Platform Notes

In IOS-XE (e.g., 16.x), the 'radius server' configuration mode is identical to classic IOS. However, IOS-XE supports 'key 0' (plaintext), 'key 7' (encrypted), and 'key 6' (AES encrypted) syntax. The 'key' command under 'radius server' is the same.

In NX-OS (e.g., Nexus 9000), the equivalent is 'radius-server key [shared-secret]' under global config, but NX-OS also supports per-server keys using 'radius-server host [ip] key [shared-secret]'. For ASA (Adaptive Security Appliance), the command is 'radius-server key [shared-secret]' under global config, and per-server keys are set with 'radius-server host [ip] key [shared-secret]'. In IOS-XR, the equivalent is 'radius-server key [shared-secret]' under global config, but XR uses a different AAA model.

Note that in older IOS versions (12.x), the 'key' command was under 'radius-server host' directly, not in a separate 'radius server' sub-mode. The newer per-server configuration (introduced in 15.x) is recommended. In IOS-XE 16.x and later, the 'radius server' sub-mode is fully supported.

For all platforms, the key length limit is 128 characters. In NX-OS, the key is stored as type 7 by default; type 6 requires additional configuration. In ASA, the key is stored as type 8 (PBKDF2) in newer versions.

Always check the specific platform documentation for encryption type support.

Related Commands

aaa new-model

Enables AAA (Authentication, Authorization, and Accounting) security services on a Cisco device, required before configuring any AAA commands.

service password-encryption

Enables Cisco Type 7 (Vigenère cipher) encryption for all plaintext passwords stored in the running configuration, including line passwords, CHAP passwords, and username passwords not already using stronger hashing.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions