• SonicOS 7.0 Users
• About User Management
  • Using Local Users and Groups for Authentication
    • About User Databases
    • About User Groups
  • Using RADIUS for Authentication
  • Using LDAP/Active Directory/eDirectory Authentication
    • LDAP Terms
    • LDAP Directory Services Supported in SonicOS
    • LDAP User Group Mirroring
      • Integrating LDAP into the SonicOS Network Security Appliance
        • Preparing Your LDAP Server for Integration
        • Configuring the CA on the Active Directory Server
        • Exporting the CA Certificate from the Active Directory Server
        • Importing the CA Certificate into SonicOS
      • LDAP Group Membership by Organizational Unit
  • Using RADIUS
  • Using TACACS+
  • Using Single Sign-On
    • What is Single Sign-On?
    • Benefits of SonicWall SSO
    • Platforms and Supported Standards
    • How Does Single Sign-On Work?
      • SonicWall SSO Authentication Using the SSO Agent
      • SonicWall SSO Authentication Using the Terminal Services Agent
      • SonicWall SSO Authentication Using Browser NTLM Authentication
    • How Does SSO Agent Work?
      • Logging
    • How Does Terminal Services Agent Work?
      • Multiple TSA Support
      • Encryption of TSA Messages and Use of Session IDs
      • Connections to Local Subnets
      • Non-Domain User Traffic from the Terminal Server
    • How Does Browser NTLM Authentication Work?
      • NTLM Authentication of Domain Users
      • NTLM Authentication of Non-Domain Users
      • Credentials for NTLM Authentication in the Browser
    • How Does RADIUS Accounting for Single-Sign-On Work?
      • RADIUS Accounting Messages
      • SonicWall Compatibility with Third-Party Network Appliances
      • Proxy Forwarding
      • Non-Domain Users
      • IPv6 Considerations
      • RADIUS Accounting Server Port
    • Installing the Single Sign-On Agent and/or Terminal Services Agent
      • Installing the SonicWall SSO Agent
      • Installing the SonicWall Terminal Services Agent
        • Accessing the SonicWall Terminal Services Agent
        • Creating a SonicWall TSA Troubleshooting Report
    • Single Sign-On Advanced Features
      • Viewing SSO Mouseover Statistics
      • Using the Single Sign-On Statistics in the TSR
      • Examining the Agent
      • Remedies
    • Configuring Access Rules
      • Automatically Generated Rules for SonicWall SSO
      • Accommodating Mac and Linux Users
        • Using SSO on Mac and Linux With Samba
        • Using SSO on Mac and Linux Without Samba
      • Allowing ICMP Pings from a Terminal Server
    • Managing SonicOS with HTTP Login from a Terminal Server
    • Viewing and Managing SSO User Sessions
      • Logging Out SSO Users
      • Configuring Additional SSO User Settings
      • Viewing SSO and LDAP Messages with Packet Monitor
      • Capturing SSO Messages
      • Capturing LDAP Over TLS Messages
    • Multiple Administrator Support
      • Preempting Administrators
      • Logging in with Administrator Rights
        • Disabling the User Login Status Popup
      • Configuring Multiple Administrator Support
        • Configuring Additional Administrator User Profiles
        • Configuring Administrators Locally when Using LDAP or RADIUS
        • Verifying Multiple Administrators Support Configuration
        • Viewing Multiple Administrator Related Log Messages
• Configuring Users Status
  • Displaying Inactive Users
  • Displaying Unauthenticated Users
  • Displaying the User Count
  • Refreshing the Users List
  • Logging Out Users
    • Logging Out a Single User
    • Logging Out Multiple Users
• Configuring User Settings
  • User Login Settings
    • Setting the Authentication Method for Login
    • Configuring RADIUS Authentication
      • Configuring RADIUS Settings
      • Configuring RADIUS Users Settings
      • Testing RADIUS Settings
    • Configuring LDAP
      • Configuring LDAP Setting
      • Configuring Referrals
      • LDAP User Settings
      • Enabling LDAP Relay
      • Testing LDAP Settings
    • Configuring TACACS+
      • Configuring TACAS+ Settings
      • Configuring TACACS+ User Settings
      • Testing TACACS+ Settings
    • Requiring User Names be Treated as Case-Sensitive
    • Preventing Users From Logging in from More than One Location
    • Forcing Users to Log In Immediately After Changing Their Passwords
    • Displaying User Login Information Since the Last Login
  • Setting the Single-Sign-On Methods
    • Configuring SSO
      • SSO Agents
      • Users
      • Enforcement
      • Terminal Services
      • NTLM
      • RADIUS Accounting
      • 3rd Party API
      • Capture Client
      • Test
  • One-Time Password Settings
  • Configuring the User Web Login Settings
    • Setting the Timeout for the Authentication Page
    • Setting How the Browser is Redirected
    • Managing Redirections to the Login Page
    • Using a CHAP challenge to Authenticate Users
    • Redirecting Unauthenticated Users
    • Authenticating user's multiple IP addresses
  • Adding URLs to Authentication Bypass
  • User Session Settings
    • User Session Settings for SSO-Authenticated Users
    • User Session Settings for Web Login
  • Accounting
    • Configuring RADIUS Accounting
      • Sending RADIUS Accounting Information to Servers
      • Configuring User Accounting
      • Testing RADIUS Accounting
      • Editing RADIUS Servers
      • Deleting RADIUS Servers
    • Configuring TACACS+ Accounting
      • Configuring User Accounting
      • Testing TACACS Accounting
      • Editing TACACS Servers
      • Deleting TACACS Servers
  • [[[Missing Linked File System.LinkedTitle]]]
    • • Post-Login Acceptable Use Policy Example Template
      • Post-Login Acceptable Use Policy Preview Message
• Configuring and Managing Partitions
  • Authentication Partitioning Settings
  • Authentication Partitions
    • Adding Partitions and Subpartitions
    • Editing Partitions
    • Deleting Partitions and Subpartitions
      • Deleting All Partitions
      • Deleting Multiple Partitions
      • Deleting a Single Partition
  • Assigning Servers, Agents, and Clients
    • Manually Assigning Servers, Agents, and Clients
    • Automatically Assigning Servers, Agents, and Clients
  • Partition Selection Policies
    • Adding Partition Policies
    • Deleting Partitions Policies
      • Deleting All Partitions Policies
      • Deleting Multiple Partitions Policies
      • Deleting a Single Partition Policiy
• Configuring Local Users and Groups
  • About Authentication and Passwords
    • Using Two-Factor Authentication
    • Enforcing First Login Password Change
  • Configuring Local Users
    • Quota Control for all Users
    • Viewing Local Users
    • Adding Local Users
      • Configuring Local Users Settings
      • Configuring Local Users Groups
      • Configuring Local Users VPN Access
      • Configuring Local Users User Quota
    • Editing Local Users
  • Configuring Local Groups
    • Adding Local Groups
      • Configuring Local Groups Settings
      • Configuring Local Group Settings Members
      • Configuring Local Group Settings VPN Access
      • Configuring Local Group Settings Administration
    • Editing Local Groups
  • Settings
• Configuring Guest Services
  • Adding Guest Profiles
  • Editing Guest Profiles
  • Deleting Guest Profiles
• Configuring Guest Accounts
  • Adding Guest Accounts
  • Editing Guest Accounts
  • Deleting Guest Accounts
    • Deleting a Guest Account
    • Deleting Multiple Guest Accounts
    • Deleting All Guest Accounts
• Managing Guest Status
  • Logging Out Guests
  • Logging Out All Guests
• SonicWall Support
  • About This Document

RADIUS Accounting

Single Sign-On by RADIUS accounting allows the appliance to act as a RADIUS accounting server for external third-party appliances, and to log users in or out based on the accounting messages from those devices. For third-party appliances that use RADIUS accounting for other purposes, SonicOS can also forward the RADIUS accounting messages to another RADIUS accounting server.

1. Navigate to the Device > Users > Settings > Authentication page.
2. Next to Configure SSO, click Configure.

   The SSO Configuration page is displayed.

3. In the RADIUS Accounting tab, under Accounting Clients select the following:

   1. Click Add Client.

   2. Under the Settings tab, do the following:

      1. In the Client host name or IP address field, enter the name or the IP address for the RADIUS client host.

      2. If partitioning has been configured then in the Partition drop-down menu select the Default.

      3. In the Shared Key field and the Confirm Shared Key field, enter your shared secret for the client.

      4. Click Save.

   3. Under the Radius tab, do the following:

      1. From the User-Name attribute format drop-down menu, select the format for the user name login. You can select from some common formats:

         • User-name

         • Domain\User-name

         • Domain/User-name

         • User-name@Domain

         • SonicWALL Aventail

         • Or, you can select a non-standard format, Others.

      2. If you selected User-name go to Select a Log user out if no accounting interim updates are received option.

      3. If you select Others, more settings appear so you can configure the components to be found in the attribute:

         1. In Format enter a limited scanf-style string, with either a %s or %[…] directive for each component.

         2. Click Add Component.

         3. Select the This is the last component.

         4. Select the type of component from the Component to add drop-down menu:

            • User-name

            • Domain

            • DN

         5. Enter text to separate entries in the Any text that precedes it and Any text that follows it fields.

         6. Click Add.

         7. To delete the last component you added, click Remove last.

      4. Select a Log user out if no accounting interim updates are received option.

         • Disabled: to not have messages sent.

         • Enabled: to manually specify the Timeout interval. Set the timeout value greater than the period at which the RADIUS Accounting client sends the Interim-Update messages, and for dropped/missed Interim-Update messages, set the Timeout value at least 2 to 3 times greater than the period.

         • Auto (default): to have the appliance detect automatically whether Interim-Update message are being sent periodically and, if they are, to use them as specified under Enabled and setting automatically the timeout accordingly.

      5. Click Save.
   4. Under the Forwarding tab, do the following:

      1. You can enter up to four RADIUS accounting servers in these fields:

         • Name or IP address

         • Port (default 1813)

         • Shared Secret for the RADIUS accounting servers to which you want the client to forward message

         • Confirm Shared Secret

      2. When you enter this information for a server, the Select from drop down menu displays.

         • No forwarding

         • IP address of the accounting server

      3. In the Timeout (seconds) field, enter the timeout period in seconds. The default for Timeout (seconds) is 10 seconds,

      4. In the Retries field enter and the number of retries. The default for retries is 3.

   5. Select how the RADIUS accounting messages are forwarded from this client, either:

      • Try next on timeout
      • Forward to all
4. In the General Settings tab, do the following:

   1. Enable SSO or RADIUS accounting by selecting the Enable SSO or RADIUS accounting. This setting is enabled by default.

   2. Specify the port in the Port number field. The default port is 1813.

   3. In Mechanism for looking up user group memberships for RADIUS Accounting users select one of the following:

      • Use the mechanism selected on the SSO Users tab

      • Use Filter-Id attribute from RADIUS Accounting requests

5. Click Save.
6. In the Advanced Settings tab, do the following:
   1. Select Expect Start/Stop messages due to wireless roaming to notify the SonicWall of users connecting/disconnecting.

   2. In the Maximum switch-over time(seconds) enter in seconds. The default is 30 seconds.

   3. In Wireless Roaming Transitions select one of the following:

      • Expect logical transitions

      • Ignore transition message sequence/source(s)

   4. Select to ignore any radius accounting messages in For users at these IP addresses and For users not at these IP addresses.

   5. Click Add User Names.

   6. Select Begin with or End with in Ignore any user names that.

7. Click Save.