7
Figure 5
Segment of a RADIUS packet containing an extended attribute
HWTACACS
HWTACACS is an enhanced security protocol based on TACACS (RFC 1492). Similar to RADIUS, it
uses a client/server model for information exchange between the NAS and the HWTACACS server.
HWTACACS typically provides AAA services for PPP users, VPDN users, and terminal users. In a typical
HWTACACS scenario, some terminal users must log in to the NAS for operations. Working as the
HWTACACS client, the NAS sends the usernames and passwords of the users to the HWTACACS sever
for authentication. After passing authentication and being authorized, the users log in to the switch and
perform operations, and the HWTACACS server records the operations that each user performs.
Differences between HWTACACS and RADIUS
HWTACACS and RADIUS both provide authentication, authorization, and accounting services. They
have many features in common, such as using a client/server model, using shared keys for user
information security, and providing flexibility and extensibility.
lists their differences.
Table 3
Primary differences between HWTACACS and RADIUS
HWTACACS RADIUS
Uses TCP, providing more reliable network
transmission.
Uses UDP, providing higher transport efficiency.
Encrypts the entire packet except for the
HWTACACS header.
Encrypts only the user password field in an
authentication packet.
Protocol packets are complicated, and authorization
is independent of authentication. Authentication and
authorization can be deployed on different
HWTACACS servers.
Protocol packets are simple, and the authorization
process is combined with the authentication process.
Supports authorization of configuration commands.
The commands that a user can use are determined
by both the user level and the AAA authorization. A
user can use only commands that are at, or lower
than, the user level and authorized by the
HWTACACS server.
Does not support authorization of configuration
commands. The commands that a user can use are
solely determined by the level of the user. A user can
use all commands at, or lower than, the user level.
Basic HWTACACS message exchange process
The following example describes how HWTACACS performs user authentication, authorization, and
accounting for a Telnet user. See
.
