Table of Contents
Advertisement
RUGGEDCOM ROS
User Guide
•
Section 4.8.2, "Managing TACACS+ Authentication"
Section 4.8.1
Managing RADIUS Authentication
RUGGEDCOM ROS can be configured to act as a RADIUS client and forward user credentials to a RADIUS (Remote
Authentication Dial In User Service) server for remote authentication and authorization.
RADIUS is a UDP-based protocol used for carrying authentication, authorization and configuration information
between a Network Access Server (NAS) that desires to authenticate its links and a shared authentication server. It
provides centralized authentication and authorization for network access.
RADIUS is also widely used in conjunction with the IEEE 802.1X standard for port security using the Extensible
Authentication Protocol (EAP).
NOTE
For more information about the RADIUS protocol, refer to
For more information about the Extensible Authentication Protocol (EAP), refer to
IMPORTANT!
RADIUS messages are sent as UDP messages. The switch and the RADIUS server must use the same
authentication and encryption key.
IMPORTANT!
RUGGEDCOM ROS supports both Protected Extensible Authentication Protocol (PEAP) and EAP-MD5.
PEAP is more secure and is recommended if available in the supplicant.
In a RADIUS access request, the following attributes and values are typically sent by the RADIUS client to the
RADIUS server:
Attribute
User-Name
User-Password
Service-Type
Vendor-Specific
A RADIUS server may also be used to authenticate access on ports with 802.1X security support. When this is
required, the following attributes are sent by the RADIUS client to the RADIUS server:
Attribute
User-Name
NAS-IP-Address
Service-Type
Frame-MTU
Managing RADIUS Authentication
Value
{ Guest, Operator, Admin }
{ password }
1
Vendor-ID: 15004
Type: 1
Length: 11
String: RuggedCom
Value
{ The username as derived from the client's EAP identity response }
{ The Network Access Server IP address }
2
1500
RFC
2865.
Chapter 4
System Administration
RFC
3748.
103
Advertisement
Table of Contents
