Configure RADIUS authentication on chassis cluster where the RADIUS server is reachable via the fxp0 interface.
RADIUS authentication for local node management configured via the fxp0 interface.
In order to configure RADIUS authentication on the above scenario the RADIUS configuration must to configured under the node groups with the source address referencing the fxp0 interface address for that node, if we use the master-only address as source address then the RG0 secondary node will not be able to reach the server due to "can't assign requested address".
Configuration example:
set groups node0 interfaces fxp0 unit 0 family inet address 192.168.1.1/24
set groups node1 interfaces fxp0 unit 0 family inet address 192.168.1.5/24 master-only
set groups node0 system radius-server 192.168.1.100 routing-instance mgmt_junos
set groups node0 system radius-server 192.168.1.100
set groups node0 system radius-server 192.168.1.100 secret <RADIUS secret>
set groups node0 system radius-server 192.168.1.100 source-address 192.168.1.1
set groups node1 interfaces fxp0 unit 0 family inet address 192.168.1.2/24
set groups node1 system radius-server 192.168.1.100 routing-instance mgmt_junos
set groups node1 system radius-server 192.168.1.100
set groups node1 system radius-server 192.168.1.100 secret <RADIUS secret>
set groups node1 system radius-server 192.168.1.100 source-address 192.168.1.2
In the above example the RADIUS server and the fxp0 interfaces are on the same broadcast domain however if they are in different subnets then the backup-router must be configured so that the RG0 secondary node has the necessary routing information to reach the RADIUS server, refer to https://www.juniper.net/documentation/us/en/software/junos/junos-getting-started/topics/task/backup-router-configuring.html.
2024-04-29: Article Created2026-01-29: Updated Categories