Lenovo Flex System Fabric CN4093, Application Manual

Page: 104 / 634

104
CN4093 Application Guide for N/OS 8.4
Authentication
Enterprise NOS supports authentication, authorization, and accounting with
networks using the Cisco Systems protocol. The CN4093 functions as
the Network Access Server (NAS) by interacting with the remote client and
initiating authentication and authorization sessions with the access
server. The remote user is defined as someone requiring management access to the
CN4093 either through a data or management port.
offers the following advantages over RADIUS:
 uses TCP ‐ based connection ‐ oriented transport; whereas RADIUS is
UDP ‐ based. TCP offers a connection ‐ oriented transport, while UDP offers
best ‐ effort delivery. RADIUS requires additional programmable variables such
as re ‐ transmit attempts and time ‐ outs to compensate for best ‐ effort transport,
but it lacks the level of built ‐ in support that a TCP transport offers.
 offers full packet encryption whereas RADIUS offers password ‐ only
encryption in authentication requests.
 separates authentication, authorization and accounting.
How Authentication Works
works much in the same way as RADIUS authentication as described on
page 100 .
1.
Remote administrator connects to the switch and provides user name and
password.
2.
Using Authentication/Authorization protocol, the switch sends request to
authentication server.
3.
Authentication server checks the request against the user ID database.
4.
Using protocol, the authentication server instructs the switch to grant or
deny administrative access.
During a session, if additional authorization checking is needed, the switch checks
with a server to determine if the user is granted permission to use a
particular command.f