3Com 7700 Configuration Manual page 194

186 C 9: AAA
HAPTER AND
RADIUS O
PERATION
Authorizes the user with specified services.
■
Accounts for network resources that are consumed by the user.
■
Generally, by applying client/server architecture, AAA framework boasts the
following advantages:
Good scalability.
■
Able to use standard authentication schemes.
■
Easy control and convenient for centralized management of user information.
■
Able to use multiple-level backup systems to enhance the security of the whole
■
framework.
As mentioned above, AAA is a management framework, so it can be implemented
by some protocols. RADIUS is frequently used.
Remote Authentication Dial-In User Service, RADIUS for short, is distributed
information switching protocol in Client/Server architecture. RADIUS can prevent
the network from interruption of unauthorized access and it is often used in the
network environments requiring both high security and remote user access. For
example, it is often used for managing a large number of scattering dial-in users
who use serial ports and modems. RADIUS system is the important auxiliary part of
Network Access Server (NAS).
After RADIUS system is started, if the user wants to access other networks or use
network resources through connection to NAS (dial-in access server in PSTN
environment or Ethernet switch with access function in Ethernet environment),
NAS, namely RADIUS client end and will transmit user AAA request to the RADIUS
server. RADIUS server has a user database recording all the information of user
authentication and network services. When receiving user's request from NAS,
RADIUS server performs AAA through user database query and update and
returns the configuration information and accounting data to NAS. NAS then
controls supplicant and corresponding connections, while RADIUS protocol
regulates how to transmit configuration and accounting information between
NAS and RADIUS.
NAS and RADIUS exchange the information with UDP packets. During the
interaction, both sides encrypt the packets with keys before uploading user
configuration information (like password etc.) to avoid being intercepted or stolen.
RADIUS server generally uses proxy function of the devices like access server to
perform user authentication. The operation process is as follows:
1 Send client username and encrypted password to RADIUS server.
2 User receives one of the following response messages:
ACCEPT: Indicates that the user has passed the authentication
■
REJECT: Indicates that the user has not passed the authentication and needs to
■
input username and password again, otherwise he will be rejected to access.
Implementing AAA/RADIUS on Ethernet Switch
By now, we understand that in the Switch 7700, serving as the user access device
or NAS, is the client end of RADIUS. In other words, the AAA/RADIUS concerning