Authentication, Authorization and Accounting (AAA) for ERS and ES
Technical Configuration Guide
7
November 2010
avaya.com
2.1.1 RADIUS Authentication
With RADIUS authentication, a remote RADIUS client can authenticate users attempting to log in. The
RADIUS server also provides access authority. RADIUS assists network security and authorization by
managing a database of users. The switch can use the database to verify user names and passwords, as
well as information about the type of access priority available to the user.
When the RADIUS client sends an authentication request, if the RADIUS server requires additional
information, such as a SecurID number, it sends a
challenge-response
. Along with the challenge-
response, a reply-message attribute is sent. The reply-message is a text string, such as "Please enter the
next number on your SecurID card". The maximum length of each reply-message attribute is 253
characters (as defined by the RFC). If you have multiple instances of reply-message attributes that
together form a large message which can be displayed to the user, the maximum total length is 2000
characters.
802.1x (EAP), if enabled, has a mandatory requirement to authenticate users by Radius.
Hence, Layer two switches supporting 802.1x (EAP) support RADIUS authentication.
RADIUS
SERVER
Authentication
Service
RADIUS
CLIENT
AUTHENTICATION
USER LOGIN
(Console/Telnet/SSH)
ACCESS REQUEST
USER NAME
(User Password :
128bits keyed MD5)
CLIENT ID
PORT ID
ACCESS CHALLENGE
STATE (1)
ACCESS ACCEPT
CONFIG VALUES
(1) Used when Radius server requires additional information such as
SecurID number.
