Introduction To Radius; Client/Server Model - 3Com 4500G Family Configuration Manual

When a user tries to establish a connection to the NAS and to obtain the rights to access other networks
or some network resources, the NAS authenticates the user or the corresponding connection. The NAS
can transparently pass the user's AAA information to the server (RADIUS server or HWTACACS server).
The RADIUS/HWTACACS protocol defines how a NAS and a server exchange user information
between them.
In the AAA network shown in
determine the authentication, authorization and accounting methods according to the actual
requirements. For example, you can use the HWTACACS server for authentication and authorization,
and the RADIUS server for accounting.
The three security functions are described as follows:
Authentication: Identifies remote users and judges whether a user is legal.
Authorization: Grants different users different rights. For example, a user logging into the server
can be granted the permission to access and print the files in the server.
Accounting: Records all network service usage information of users, including the service type,
start and end time, and traffic. In this way, accounting can be used for not only charging, but also
network security surveillance.
You can use AAA to provide only one or two security functions, if desired. For example, if your company
only wants employees to be authenticated before they access specific resources, you only need to
configure an authentication server. If network usage information is expected to be recorded, you also
need to configure an accounting server.
As described above, AAA provides a uniform framework to implement network security management. It
is a security mechanism that enables authenticated and authorized entities to access specific resources
and records operations of the entities. The AAA framework thus allows for excellent scalability and
centralized user information management.
AAA can be implemented through multiple protocols. Currently, the device supports using RADIUS,
HWTACACS for AAA, and RADIUS is often used in practice.

Introduction to RADIUS

Remote Authentication Dial-In User Service (RADIUS) is a distributed information interaction protocol in
a client/server model. RADIUS can protect networks against unauthorized access and is often used in
network environments where both high security and remote user access are required. Based on UDP,
RADIUS uses UDP port 1812 for authentication and 1813 for accounting. RADIUS defines the RADIUS
packet format and message transfer mechanism.
RADIUS was originally designed for dial-in user access. With the diversification of access methods,
RADIUS has been extended to support more access methods, for example, Ethernet access and ADSL
access. It uses authentication and authorization in providing access services and uses accounting to
collect and record usage information of network resources.

Client/Server Model

Client: The RADIUS client runs on the NASs located throughout the network. It passes user
information to designated RADIUS servers and acts on the responses (for example, rejects or
accepts user access requests).
Server: The RADIUS server runs on the computer or workstation at the network center and
maintains information related to user authentication and network service access. It listens to
Figure 1-1, there is a RADIUS server and a HWTACACS server. You can
1-2