Configure your LR54 device to use a RADIUS server

This section describes how to configure a LR54 device to use a RADIUS server for authentication and authorization.

Required configuration items

Define the RADIUS server IP address or domain name.
Define the RADIUS server shared secret.
Add RADIUS as an authentication method for your LR54 device.

Additional configuration items

Whether other user authentication methods should be used in addition to the RADIUS server, or if the RADIUS server should be considered the authoritative login method.
The RADIUS server port. It is configured to 1812 by default.
Add additional RADIUS servers in case the first RADIUS server is unavailable.
The server NAS ID. If left blank, the default value is used:
- If you are access the LR54 device by using the WebUI, the default value is for NAS ID is httpd.
- If you are access the LR54 device by using ssh, the default value is sshd.
Time in seconds before the request to the server times out. The default is 3 seconds and the maximum possible value is 60 seconds.
Enable additional debug messages from the RADIUS client.

 Web

Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
Access the device configuration:
Remote Manager:
1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
2. Click the Device ID.
3. Click Settings.
4. Click to expand Config.
Local Web UI:
1. On the menu, click System. Under Configuration, click Device Configuration.
  The Configuration window is displayed.
Click Authentication > RADIUS > Servers.
Add RADIUS servers:
1. For Add server, click .
2. For Hostname, type the hostname or IP address of the RADIUS server.
3. (Optional) Change the default Port setting to the appropriate port. Normally this should be left at the default setting of port 1812.
4. For Secret, type the RADIUS server's shared secret. This is configured in the secret parameter of the RADIUS server's client.conf file, for example:
```
secret=testing123
```
5. For Timeout, type or select the amount of time in seconds to wait for the RADIUS server to respond. Allowed value is any integer from 3 to 60. The default value is 3.
6. (Optional) Click  again to add additional RADIUS servers.
(Optional) Enable Authoritative to prevent other authentication methods from being attempted if RADIUS login fails.
(Optional) Click RADIUS debug to enable additional debug messages from the RADIUS client.
(Optional) For NAS ID, type the unique identifier for this network access server (NAS). You can use the fully-qualified domain name of the NAS or any arbitrary string. If not set, the default value is used:
- If you are accessing the LR54 device by using the WebUI, the default value is for NAS ID is httpd.
- If you are accessing the LR54 device by using ssh, the default value is sshd.
Add RADIUS to the authentication methods:
1. Click Authentication > Methods.
2. For Add method, click .
3. Select RADIUS for the new method from the Method drop-down.
Authentication methods are attempted in the order they are listed until an authentication response, either pass or fail, is received. If Authoritative is enabled (see above), non-authoritative methods are not attempted. See Rearrange the position of authentication methods for information about rearranging the position of the methods in the list.
Click Apply to save the configuration and apply the change.

 Command line

Select the device in Remote Manager and click Actions > Open Console, or log into the LR54 local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```
(Optional) Prevent other authentication methods from being used if RADIUS authentication fails. Other authentication methods will only be used if the RADIUS server is unavailable.
```
(config)> auth radius authoritative true
(config)>
```
(Optional) Enable debug messages from the RADIUS client:
```
(config)> auth radius debug true
(config)>
```
(Optional) Configure the NAS ID. This is a unique identifier for this network access server (NAS). You can use the fully-qualified domain name of the NAS or any arbitrary string. If not set, the default value is used:
- If you are accessing the LR54 device by using the WebUI, the default value is for NAS ID is httpd.
- If you are accessing the LR54 device by using ssh, the default value is sshd.
```
(config)> auth radius nas_id id
(config)> 
```
Add a RADIUS server:
1. Add the server:
```
(config)> add auth radius server end
(config auth radius server 0)> 
```
2. Enter the RADIUS server's IP address or hostname:
```
(config auth radius server 0)> hostname hostname|ip-address
(config auth radius server 0)> 
```
3. (Optional) Change the default port setting to the appropriate port:
```
(config auth radius server 0)> port port
(config auth radius server 0)> 
```
4. Configure the amount of time in seconds to wait for the RADIUS server to respond. Allowed value is any integer from 3 to 60. The default value is 3.
```
(config auth radius server 0)> timeout value
(config auth radius server 0)> 
```
5. (Optional) Repeat the above steps to add additional RADIUS servers.
Add RADIUS to the authentication methods. Authentication methods are attempted in the order they are listed until the first successful authentication result is returned. This example will add RADIUS to the end of the list. See User authentication methods for information about adding methods to the beginning or middle of the list.
```
(config)> add auth method end radius
(config)> 
```
Save the configuration and apply the change
```
(config)> save
Configuration saved.
>
```
Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.