Alteon Application Switch Operating System Application Guide
Securing Alteon
Document ID: RDWR-ALOS-V2900_AG1302
67
Authentication
Alteon supports authentication and authorization with networks using the Cisco Systems
®
protocol. Alteon functions as the Network Access Server by interacting with the remote client and
initiating authentication and authorization sessions with the access server. The remote
user is defined as someone requiring management access to Alteon either through a data or
management port.
offers the following advantages over RADIUS:
•
uses TCP-based, connection-oriented transport, while RADIUS is UDP-based. TCP
offers a connection-oriented transport, while UDP offers best-effort delivery. RADIUS requires
additional programmable variables such as re-transmit attempts and timeouts to compensate
for best-effort transport, but it lacks the level of built-in support that a TCP transport offers.
•
offers full packet encryption, while RADIUS offers password-only encryption in
authentication requests.
•
separates authentication, authorization, and accounting.
•
offers privilege level mapping. By enabling cmap, the privilege level can be increased
from default 0-9 to 0-22.
•
Alteon sends command log messages to the server when clog is enabled.
How Authentication Works
works much in the same way as RADIUS authentication, as described on
1. The remote administrator connects to Alteon and provides the user name and password.
2. Using the authentication or authorization protocol, Alteon sends the request to the
authentication server.
3. The authentication server checks the request against the user ID database.
4. Using the protocol, the authentication server instructs Alteon to grant or deny
administrative access.
uses the AAA architecture, which separates authentication, authorization, and accounting.
This allows separate authentication solutions that can still use for authorization and
accounting. For example, with , it is possible to use Kerberos authentication and
authorization and accounting. After Alteon authenticates a user on a Kerberos server, it requests
authorization information from a server without requiring re-authentication. Alteon
informs the server that it has successfully authenticated the user on a Kerberos server,
and the server then provides authorization information.
During a session, if additional authorization checking is needed, Alteon checks with a
server to determine if the user is granted permission to use a particular command.
Authentication Features
Authentication is the action of determining the identity of a user, and is generally done when the
user first attempts to log into Alteon or gain access to its services. Alteon supports ASCII inbound
logins.
The following are not supported:
•
PAP, CHAP, and ARAP login methods
•
change password requests
•
One-time password authentication
