Aaa For Mpls L3Vpns; Protocols And Standards - HP 5500 HI Series Configuration Manual

You can create and delete RADIUS clients, which are identified by IP addresses and configured
with attributes such as a shared key. With a managed client range configured, the RADIUS server
processes only the RADIUS packets from the clients within the management range. A shared key
is used to ensure secure communication between a RADIUS client and the RADIUS server.
• RADIUS authentication and authorization
With the RADIUS server enabled, the switch checks whether or not the client of an incoming RADIUS
packet is under its management. If yes, it verifies the packet validity by using the shared key, checks
whether there is an account with the username, whether the password is correct, and whether the user
attributes meet the requirements defined on the RADIUS server (for example, whether the account has
expired). Then, the RADIUS server assigns the corresponding authority to the client if the authentication
succeeds, or denies the client if the authentication fails.
NOTE:
A RADIUS server running the standard RADIUS protocol listens on UDP port 1812 for authentication
requests, but an HP switch listens on UDP port 1645 instead when acting as the RADIUS server. Be sure to
specify 1645 as the authentication port number on the RADIUS client when you use an HP switch as the
RADIUS server.

AAA for MPLS L3VPNs

In an MPLS L3VPN scenario where clients in different VPNs are centrally authenticated, you can deploy
AAA across VPNs to enable forwarding RADIUS and HWTACACS packets across MPLS VPNs. With the
AAA across VPNs feature, the PE at the left side of the MPLS backbone serves as a NAS and
transparently delivers the AAA packets of private users in VPN 1 and VPN 2 to the AAA servers in VPN
3 for centralized authentication, as shown in
VPNs do not affect each other.
Figure 9 Network diagram
VPN 1
Host
VPN 2
Host
NOTE:
This feature can also help an MCE to implement portal authentication for VPNs. For more information
about MCE, see

Protocols and standards

The following protocols and standards are related to AAA, RADIUS, and HWTACACS:
CE
NAS
PE
CE
MPLS Configuration Guide
Figure 9. Authentication packets of private users in different
MPLS backbone
PE
P
.
11
VPN 3
RADIUS
server
CE
HWTACACS
server