Cisco IE 4000, Software Configuration Manual

Page: 153 / 1066

149
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication

Networks with multiple-vendor access servers, each supporting RADIUS. For example, access servers from several
vendors use a single RADIUS server-based security database. In an IP-based network with multiple vendors’ access
servers, dial-in users are authenticated through a RADIUS server that has been customized to work with the Kerberos
security system.

Turnkey network security environments in which applications support the RADIUS protocol, such as in an access
environment that uses a
smart card access control system. In one case, RADIUS has been used with Enigma’s
security cards to validates users and to grant access to network resources.

Networks already using RADIUS. You can add a Cisco switch containing a RADIUS client to the network. This might
be the first step when you make a transition to a server.

Network in which the user must only access a single service. Using RADIUS, you can control user access to a single
host, to a single utility such as Telnet, or to the network through a protocol such as IEEE 802.1x. For more information
about this protocol, see
Configuring IEEE 802.1x Port-Based Authentication, page 189

Networks that require resource accounting. You can use RADIUS accounting independently of RADIUS
authentication or authorization. The RADIUS accounting functions allow data to be sent at the start and end of
services, showing the amount of resources (such as time, packets, bytes, and so forth) used during the session. An
Internet service provider might use a freeware-based version of RADIUS access control and accounting software to
meet special security and billing needs.
RADIUS is not suitable in these network security situations:

Multiprotocol access environments. RADIUS does not support AppleTalk Remote Access (ARA), NetBIOS Frame
Control Protocol (NBFCP), NetWare Asynchronous Services Interface (NASI), or X.25 PAD connections.

Switch-to-switch or router-to-router situations. RADIUS does not provide two-way authentication. RADIUS can be
used to authenticate from one device to a non-Cisco device if the non-Cisco device requires authentication.

Networks using a variety of services. RADIUS generally binds a user to one service model.