Bay Networks Bay Dial VPN, Configuration And Troubleshooting Manual

Page: 44 / 186

Configuring and Troubleshooting Bay Dial VPN Services
2-12 BayStream Multiservice Software Version 7.2 115623B Rev. 00
5.
The RADIUS client (in the gateway) sends a request to the RADIUS
server to authenticate the remote user.
During remote authentication, the RADIUS authentication server on the
corporate home network verifies that the remote node is authorized to access
the home network and determines which network services the remote node is
allowed to use.
6.
The DHCP or the remote RADIUS server assigns an IP address and
includes that address in the reply.
If the home network is configured to assign IP addresses dynamically using
DHCP, the DHCP server selects an IP address from its pool and issues the end
user a renewable “lease” on that address. Alternatively, the DHCP
administrator may assign a fixed IP address to particular users. In either case,
the DHCP server returns the assigned IP address in its reply to the gateway.
If the home network is configured to assign IP addresses using RADIUS,
either statically or dynamically, the RADIUS server performs the address
allocation. If the RADIUS administrator has allocated a pool of assignable IP
addresses for dial-in users, and if the RADIUS client on the gateway is
configured for dynamic IP address assignment, the RADIUS server assigns an
address from that pool. Alternatively, the RADIUS administrator may have
assigned a specific address for that particular user. In this case, RADIUS uses
that assigned address. The RADIUS server reserves the assigned IP address
for that user until the session terminates.
7.
When authentication and address allocation are complete, the NAS starts
sending packets from the remote node to the gateway via the newly
created tunnel.
Note: TMS may deny a tunnel request for a number of reasons; for example, if
the maximum number of users has been reached, if TMS does not find a match
for the domain name in its database, or if the authentication request fails. If the
tunnel request is denied, the connection between the NAS and the remote node
is dropped.