Hwtacacs - HP A5830 Series Configuration Manual

Figure 5 Segment of a RADIUS packet containing an extended attribute

HWTACACS

HWTACACS is an enhanced security protocol based on TACACS (RFC 1492). Similar to RADIUS, it
uses a client/server model for information exchange between the NAS and the HWTACACS server.
HWTACACS typically provides AAA services for PPP users, VPDN users, and terminal users. In a typical
HWTACACS scenario, some terminal users must log in to the NAS for operations. Working as the
HWTACACS client, the NAS sends the usernames and passwords of the users to the HWTACACS sever
for authentication. After passing authentication and being authorized, the users log in to the switch and
perform operations, and the HWTACACS server records the operations that each user performs.
Differences between HWTACACS and RADIUS
HWTACACS and RADIUS both provide authentication, authorization, and accounting services. They
have many features in common, such as using a client/server model, using shared keys for user
information security, and providing flexibility and extensibility.
Table 3 Primary differences between HWTACACS and RADIUS
HWTACACS
Uses TCP, providing more reliable network
transmission.
Encrypts the entire packet except for the
HWTACACS header.
Protocol packets are complicated, and authorization
is independent of authentication. Authentication and
authorization can be deployed on different
HWTACACS servers.
Supports authorization of configuration commands.
The commands that a user can use are determined
by both the user level and the AAA authorization. A
user can use only commands that are at, or lower
than, the user level and authorized by the
HWTACACS server.
Basic HWTACACS message exchange process
The following example describes how HWTACACS performs user authentication, authorization, and
accounting for a Telnet user. See
RADIUS
Uses UDP, providing higher transport efficiency.
Encrypts only the user password field in an
authentication packet.
Protocol packets are simple, and the authorization
process is combined with the authentication process.
Does not support authorization of configuration
commands. The commands that a user can use are
solely determined by the level of the user. A user can
use all commands at, or lower than, the user level.
Figure 6.
7
Table 3 lists their differences.