RADIUS
The RADIUS client lives in the radius view and applies live on commit — servers are re-resolved and scalars updated in place. The one exception is coa-port, whose listener re-binds only at boot.
Server list and failover
The server list is index-addressable; insert, delete and move reorder failover priority. Default ports are 1812 for auth and 1813 for accounting.
system-view radius server add 198.51.100.10 secret <shared-secret> radius nas-id netvyn-bng-01 radius timeout 2 radius retries 3 radius interim-interval 300 commit show radius statistics
Message-Authenticator
Attribute 80 is an HMAC-MD5 signature over the whole packet keyed with the shared secret. Keep it on: RADIUS/UDP’s Response Authenticator is raw MD5 and chosen-prefix collidable, so an on-path attacker can forge an Access-Accept out of an Access-Reject (CVE-2024-3596). HMAC-MD5 is unaffected. Modern servers increasingly require attribute 80 and silently drop requests without it, which presents as a total authentication outage rather than a protocol error.
radius message-authenticator on # off | on (default) | require show radius statistics # watch bad-msg-authent.
CoA and Disconnect
Change-of-Authorization per RFC 5176 pushes plan changes and disconnects to a live session without teardown, and the QoS engine rebinds the shaper in place. Only User-Password, Tunnel-Password and the MS-MPPE keys are obfuscated in RADIUS — everything else, including all Netvyn VSAs, is plaintext on the wire.