Introduction To Radius; Client/Server Model - H3C S9500E Series Security Configuration Manual

•
Accounting: Records all network service usage information of users. This includes the service
type, start and end time, and traffic. In this way, accounting can be used for charging and
network security surveillance.
You can use AAA to provide one or two security functions. For example, if your company only
wants employees to be authenticated before they access specific resources, you only need to
configure an authentication server. If network usage information is needs to be recorded, you must
also configure an accounting server.
AAA provides a uniform framework to implement network security management. It is a security
mechanism that enables authenticated and authorized entities to access specific resources and
records operations of the entities. The AAA framework thus allows for scalability and centralized
user information management.
AAA can be implemented through multiple protocols. Currently, the switch supports using RADIUS,
and HWTACACS for AAA, and RADIUS is often used in practice.

Introduction to RADIUS

Remote authentication dial-in user service (RADIUS) is a distributed information interaction protocol
in a client/server model. RADIUS can protect networks against unauthorized access and is often
used in network environments where both high security and remote user access are required.
Based on UDP, RADIUS uses UDP port 1812 for authentication and 1813 for accounting. RADIUS
defines the RADIUS packet format and message transfer mechanism.
RADIUS was originally designed for dial-in user access. With the diversification of access
methods, RADIUS now supports additional access methods, such as Ethernet and ADSL access.
RADIUS uses authentication and authorization when providing access services and uses
accounting to collect and record usage information of network resources.

Client/Server model

•
Client: The RADIUS client runs on the NASs located throughout the network. It passes user
information to designated RADIUS servers and acts on the responses (for example, rejects or
accepts user access requests).
•
Server: The RADIUS server runs on the computer or workstation at the network center and
maintains information related to user authentication and network service access. It listens to
connection requests, authenticates users, and returns the processing results (for example,
rejecting or accepting the user access request) to the clients.
In general, the RADIUS server maintains three databases: Users, Clients, and Dictionary. See
Figure 2:
15