Hwtacacs - HP 10500 Series Configuration Manual

HWTACACS

HW Terminal Access Controller Access Control System (HWTACACS) is an enhanced security protocol
based on TACACS (RFC 1492). Similar to RADIUS, it uses a client/server model for information
exchange between the NAS and the HWTACACS server.
HWTACACS typically provides AAA services for PPP users, VPDN users, and terminal users. In a typical
HWTACACS scenario, some terminal users need to log in to the NAS for operations. Working as the
HWTACACS client, the NAS sends the username and password of the user to the HWTACACS sever for
authentication. After passing authentication and getting authorized rights, the user logs in to the device
and performs operations. The HWTACACS server records the operations that the user performs.
Differences between HWTACACS and RADIUS
HWTACACS and RADIUS have many features in common, such as using a client/server model, using
shared keys for user information security, and providing flexibility and extensibility.
primary differences.
Table 3 Primary differences between HWTACACS and RADIUS
HWTACACS
Uses TCP, providing more reliable network
transmission.
Encrypts the entire packet except for the HWTACACS
header.
Protocol packets are complicated, and authorization
is independent of authentication. Authentication and
authorization can be deployed on different
HWTACACS servers.
Supports authorization of configuration commands.
The commands that a user can access depend on both
the user level and AAA authorization. A user can use
only commands that are at, or lower than, the user
level and authorized by the HWTACACS server.
Basic HWTACACS message exchange process
The following takes a Telnet user as an example to describe how HWTACACS performs user
authentication, authorization, and accounting.
RADIUS
Uses UDP, providing higher transport efficiency.
Encrypts only the user password field in an
authentication packet.
Protocol packets are simple, and the authorization
process is combined with the authentication process.
Does not support authorization of configuration
commands. The commands that a user can access
solely depend on the level of the user. A user can use
all commands at, or lower than, the user level.
7
Table 3 lists the