Enabling RADIUS Attributes

This describes how to configure RADIUS attributes and add them to a client. To enable VLAN attributes check out Enabling VLAN via RADIUS Attributes for specific setup information.

1. Create the Attribute Set

Go to the 'RADIUS Attributes' page and click the 'Add Attributes' button. Name your Attribute Set to create it.

RADIUS Attributes interfaceRADIUS Attributes interface

RADIUS Attributes interface

2. Configure the constant attributes

Click the 'Add Attribute' button in the 'Constant Attributes' section. Select the attribute and the value to be returned.

Constant attributes are returned with any successful login, regardless of user.

RADIUS Attributes interfaceRADIUS Attributes interface

RADIUS Attributes interface

3. Configure the conditional attributes

Click the 'Add Attribute' button in the 'Conditional Attributes' section. Select the attribute and the default value to be returned. Click the 'Add Condition' button to add conditions to the return value.

Conditional attributes are evaluated in order. The first group listed that the authenticated user is a member of determines the value returned. If the user is not a member of any of the groups listed, the default value is returned.

RADIUS Attributes interfaceRADIUS Attributes interface

RADIUS Attributes interface

4. Configure the MAC address attributes

Click the 'Add Attribute' button in the 'MAC Address Conditional Attributes' section. Select the MAC entry and the default value to be returned. Click the 'Add Condition' button to add conditions to the return value.

MAC address conditional attributes are evaluated by the longest matching prefix first. The longest MAC entry matching prefix determines the value returned. If the MAC address does not match any MAC entries listed, the default value is returned. If the MAC address does not match any MAC entries at all, the request is rejected.

RADIUS Attributes interfaceRADIUS Attributes interface

RADIUS Attributes interface

5. Assign the attributes to a client

Go to the 'RADIUS Clients' page. In the 'RADIUS Attributes' column, select an Attribute Set. Whenever a request is sent to that client, successful logins will return attributes according to the Attribute Set's specifications.

RADIUS Clients interfaceRADIUS Clients interface

RADIUS Clients interface

NOTE: In order to delete an Attribute Set, it must not be associated with any RADIUS Clients.

6. Test it out

You can test out what attributes will be returned by using the "Test Attributes" feature at the bottom of the RADIUS Attributes page. Select a RADIUS Client and select a user or enter in a MAC address to see what values will be returned.