Hwtacacs - HP A6600 Configuration Manual

Vendor-Length—Indicates the length of the sub-attribute.
•
Vendor-Data—Indicates the contents of the sub-attribute.
•
Figure 5 Segment of a RADIUS packet containing an extended attribute

HWTACACS

HWTACACS is an enhanced security protocol based on TACACS (RFC 1492). Similar to RADIUS, it
uses a client/server model for information exchange between the NAS and the HWTACACS server.
HWTACACS mainly provides AAA services for PPP users, VPDN users, and terminal users. In a typical
HWTACACS application, some terminal users have to log in to the NAS for operations. Working as the
HWTACACS client, the NAS sends the username and password of a user to the HWTACACS sever for
authentication. After passing authentication and being authorized, the user logs in to the router and
performs operations, and the HWTACACS server records the operations that the user performs.
Differences between HWTACACS and RADIUS
HWTACACS and RADIUS both provide authentication, authorization, and accounting services. They
have many features in common, like using a client/server model, using shared keys for user information
security, and providing flexibility and extensibility. HWTACACS and RADIUS do have differences, as
listed in Table
Table 3 Primary differences between HWTACACS and RADIUS
HWTACACS
Uses TCP, providing more reliable network
transmission.
Encrypts the entire packet except for the
HWTACACS header.
Protocol packets are complicated, and authorization
is independent of authentication. Authentication and
authorization can be deployed on different
HWTACACS servers.
Supports authorization of configuration commands.
The commands that a user can use depend on both
the user level and AAA authorization. A user can
only use commands that are at, or lower than, the
user level and are authorized by the HWTACACS
server.
3.
RADIUS
Uses UDP, providing higher transport efficiency.
Encrypts only the user password field in an
authentication packet.
Protocol packets are simple, and the authorization
process is combined with the authentication process.
Does not support authorization of configuration
commands. The commands that a user can use
depend on the level of the user. A user can use all
the commands at, or lower than, the user level.
7