Cisco Catalyst 2960 Series, Configuration Manual

Page: 986 / 2288

the session. An Internet service provider might use a freeware-based version of RADIUS access control
and accounting software to meet special security and billing needs.
Figure 68: Transitioning from RADIUS to Services
RADIUS Operation
When a user attempts to log in and authenticate to a Switch that is access controlled by a RADIUS server,
these events occur:
1 The user is prompted to enter a username and password.
2 The username and encrypted password are sent over the network to the RADIUS server.
3 The user receives one of the following responses from the RADIUS server:
•
ACCEPT
—
The user is authenticated.
• REJECT — The user is either not authenticated and is prompted to re-enter the username and password,
or access is denied.
• CHALLENGE — A challenge requires additional data from the user.
•
CHALLENGE PASSWORD
—
A response requests the user to select a new password.
The ACCEPT or REJECT response is bundled with additional data that is used for privileged EXEC or
network authorization. The additional data included with the ACCEPT or REJECT packets includes these
items:
• Telnet, SSH, rlogin, or privileged EXEC services
• Connection parameters, including the host or client IP address, access list, and user timeouts
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
904
Information about RADIUS