H3C S9500E Series, Security Configuration Manual

Page: 22 / 207

22
•
For information about commonly used standard RADIUS attributes, see Commonly used standard RADIUS
attributes .
Extended RADIUS attributes
Attribute 26 (Vender-Specific) defined by RFC 2865 allows a vender to define extended attributes
to implement functions that the standard RADIUS protocol does not provide.
A vendor can encapsulate multiple type-length-value (TLV) sub-attributes in RADIUS packets for
extension in applications. Figure 5 shows a sub-attribute that can be encapsulated in Attribute 26
that consists of the following four parts:
•
Vendor-ID (four bytes): Indicates the ID of the vendor. Its most significant byte is 0 and the
other three bytes contain a code complying with RFC 1700. The vendor ID of H3C is 2011.
For details about the extended RADIUS attributes, see Proprietary RADIUS sub-attributes of
H3C .
•
Vendor-Type: Indicates the type of the sub-attribute.
•
Vendor-Length: Indicates the length of the sub-attribute.
•
Vendor-Data: Indicates the contents of the sub-attribute.
Figure 5 Segment of a RADIUS packet containing an extended attribute
Introduction to HWTACACS
HW Terminal Access Controller Access Control System (HWTACACS) is an enhanced security
protocol based on TACACS (RFC 1492). Similar to RADIUS, it uses a client/server model for
information exchange between NAS and HWTACACS server.
HWTACACS is typically used to provide AAA services for Point-to-Point Protocol (PPP) users, virtual
private dial-up network (VPDN) users, and terminal users. In a typical HWTACACS application, a
terminal user needs to log into the switch for operations, and HWTACACS authenticates,
authorizes, and keeps accounting for the user. Working as the HWTACACS client, the switch
sends the username and password to the HWTACACS sever for authentication. After passing
authentication and being authorized, the user can log into the switch to perform operations.
Differences between HWTACACS and RADIUS
HWTACACS and RADIUS have many common features, such as implementing AAA, using a
client/server model, using shared keys for user information security, and having flexibility and
extensibility. Table 3 lists the differences.