Skip to main content

Cisco admin interface RADIUS integration

Multi-Factor Authentication (MFA) is an extra layer of security used when logging into websites or apps. Individuals are authenticated through more than one required security and validation procedure that only they know or have access to.

Remote Authentication Dial-In User Service (RADIUS) is a protocol commonly used to authenticate, authorize, and account for user access and actions.

Arculix by SecureAuth offers a simple solution for adding MFA to Cisco™ administrative interfaces via its RADIUS solution.

Prerequisites

  • Arculix RADIUS Agent that is configured and connected to your user directory. For example, Microsoft Active Directory (AD).

    For more information, see the Arculix RADIUS Agent deployment guide.

  • User account with administrative privileges for the Cisco device.

Arculix RADIUS Agent configuration

To integrate Arculix with your Cisco device, you will need to install an Arculix RADIUS Agent on a machine within your network. This server will receive RADIUS requests from your Cisco device, check with the LDAP server to perform primary authentication, and then contact Arculix cloud service for secondary authentication.

Follow these steps to configure the Arculix RADIUS Agent.

  1. Log in to the Arculix RADIUS Agent as an administrator.

  2. Open the radius-agent-config.env file with an editor.

    The file is located in the installed directory of RADIUS Agent. RADIUS clients are configured in this setting.

    Acceptto RADIUS agent

  3. At the end of the radius-agent-config.env file, set the following configuration for the ARA_CLIENTS attribute:

    Note

    The values should be separated by semicolons (;).

    ARA_CLIENTS = <An optional name for your Cisco device>; <Internal IP address of your Cisco debvice>; <a shared secret>

    For example, set:

    ARA_CLIENTS = Cisco;192.168.1.50/32;testing12345
    ARA_CLIENTS configuration

  4. Save the file.

  5. Run the following command to apply the changes:

    docker-compose down && docker-compose up -d

Cisco device configuration

  1. Log in to your Cisco device as an administrative user and enter “enable” to gain privileged access.

  2. To start Configuration Mode, enter “configure terminal.” Complete all subsequent steps in Configuration Mode.

  3. Create a RADIUS server by running the following commands:

    RADIUS server EXAMPLE address ipv4 [ip address of Arculix RADIUS Agent] auth-port 1812 acct-port 1813 key [a key provided by your Arculix RADIUS Agent] timeout 120

    Note

    Pay attention to the step of setting the authentication and accounting ports. This is extremely important, since by default Cisco uses 1645 and 1646.

  4. Create a RADIUS server group by entering the following commands:

    aaa group server RADIUS ArculixRADIUS server name EXAMPLE source-interface [the nearest interface]

    Note

    The source interface line is optional, and depends on your internal routing.

  5. Create a login method for the newly configured RADIUS group with the following commands:

    aaa authentication login mylogin group ArculixRADIUS

    Caution

    Creating a new login method may disrupt your operations. You may want to ensure connectivity via another administrative interface or by scheduling a reload after a certain number of minutes.

  6. Associate the login method to one or more administrative interfaces.

  7. Test one of the administrative interfaces before applying it to all administrative interfaces.

    For example, to test logging in via SSH (assuming your vty numbers are from 0 to 4), issue the following commands:

    line vty 0 4
transport input ssh
transport output ssh
login authentication mylogin

Test your application integration

  1. Open a new SSH session to your Cisco device IP and log in with your Active Directory username and password.

  2. Your Arculix Mobile application will receive a push notification.

  3. After you approve the push notification, your SSH login will complete. If an error occurs, proceed to step 4.

  4. If for some reason your login session does not complete, you can remove the authentication method from the administrative interface by running the commands:

    line vty 0 4
no login authentication mylogin

Support

If you have questions or need assistance, contact SecureAuth Support.

Sales

Want to learn more about our MFA solutions? Contact our Professional Services for a demo today.

Disclaimer

All product names, trademarks, and registered trademarks are the property of their respective owners.

All company, product, and service names used in this document are for identification purposes only. The use of these names, trademarks, and brands do not constitute an endorsement by the SecureAuth Corporation.

Cisco are either registered trademarks or trademarks of Cisco, Inc. and/or one or more of its subsidiaries in the United States and/or other countries.

Active Directory are either registered trademarks or trademarks of Microsoft and/or one or more of its subsidiaries in the United States and/or other countries.

In this section: