3Com Switch 8800 Configuration Guide
Chapter 40 AAA and RADIUS/ Protocol Con
figuration
40-2
in PSTN environment or Ethernet switch with access function in Ethernet environment),
NAS, namely RADIUS client end, will transmit user AAA request to the RADIUS server.
RADIUS server has a user database recording all the information of user authentication
and network service access. When receiving user’s request from NAS, RADIUS server
performs AAA through user database query and update and returns the configuration
information and accounting data to NAS. Here, NAS controls supplicant and
corresponding connections, while RADIUS protocol regulates how to transmit
configuration and accounting information between NAS and RADIUS.
NAS and RADIUS exchange the information with UDP packets. During the interaction,
both sides encrypt the packets with keys before uploading user configuration
information (like password etc.) to avoid being intercepted or stolen.
Note:
The authentication and authorization of a RADIUS scheme cannot be performed
separately.
II. RADIUS operation
RADIUS server generally uses proxy function of the devices like access server to
perform user authentication. The operation process is as follows: First, the user send
request message (the client username and encrypted password is included in the
message ) to RADIUS server. Second, the user will receive from RADIUS server
various kinds of response messages in which the ACCEPT message indicates that the
user has passed the authentication, and the REJECT message indicates that the user
has not passed the authentication and needs to input username and password again,
otherwise he will be rejected to access.
40.1.3 Protocol Overview
I. SPECIALITY
is an enhanced security protocol based on TACACS (RFC1492). Similar to
the RADIUS protocol, it implements AAA for different types of users through
communications with TACACS servers in the Server/Client model. can be
used for the authentication, authorization and accounting of PPP and VPDN access
users and login users.
Compared with RADIUS, provides more reliable transmission and
encryption, and therefore is more suitable for security control. The following table lists
the primary differences between and RADIUS protocols:
