Introduction To Hwtacacs - H3C S7500 Series Operation Manual

Operation Manual – AAA & RADIUS & HWTACACS & EAD
H3C S7500 Series Ethernet Switches
In the packet structure shown in
of the vendor occupies four bytes. The most significant byte is 0, and the other three
bytes are defined in RFC1700. Here, the vendor can encapsulate multiple customized
sub-attributes (Type, Length and Value) for extended RADIUS implementation.
Type Type
Figure 1-4 Part of the RADIUS packet containing extended attribute

1.1.4 Introduction to HWTACACS

I. What is HWTACACS
HUAWEI Terminal Access Controller Access Control System (HWTACACS) is an
enhanced security protocol based on TACACS (RFC1492). Similar to the RADIUS
protocol, it implements AAA for different types of users (such as PPP/VPDN login users
and terminal users) through communications with TACACS servers based on a
client/server model.
Compared with RADIUS, HWTACACS provides more reliable transmission and
encryption, and therefore is more suitable for security control.
primary differences between HWTACACS and RADIUS protocols.
Table 1-3 Comparison between HWTACACS and RADIUS
Adopts TCP, providing more reliable network
transmission.
Encrypts the entire packet except the HWTACACS
header.
Separates authentication from authorization. For
example, you can provide authentication and
authorization through different TACACS servers.
Suitable for security control.
Supports to authorize the use of configuration
commands.
Length Length
Vendor-ID Vendor-ID
(specifi (specifi
Specified attribute value ...... Specified attribute value ......
HWTACACS
Chapter 1 AAA & RADIUS & HWTACACS
Figure 1-4, the Vendor-ID field representing the code
V V endor-ID endor-ID
Type Type
Length Length
ed) ed)
(specified) (specified)
1-8
Configuration
Table 1-3
RADIUS
Adopts UDP.
Encrypts only the password
field in authentication
packets.
Combines authentication
and authorization.
Suitable for accounting.
Provides no such support
lists the