750 CHAPTER 53: AAA/RADIUS/HWTACACS CONFIGURATION
A RADIUS server supports multiple user authentication methods, such as the
Password Authentication Protocol (PAP) and Challenge Handshake Authentication
Protocol (CHAP) of Point-to-Point Protocol (PPP). In addition, a RADIUS server can
act as the client of another AAA server to provide proxy authentication or
accounting service.
Basic message exchange process of RADIUS
For the interaction among the host, the RADIUS client, and the RADIUS server, see
Figure 229.
Figure 229 Basic message exchange process of RADIUS
The following is how RADIUS operates:
1 The host initiates a connection request carrying the username and password to the
RADIUS client.
2 Having received the username and password, the RADIUS client sends an
authentication request (Access-Request) to the RADIUS server, where the user
password is encrypted by the Message-Digest 5 (MD5) algorithm with the shared
key.
3 The RADIUS server authenticates the username and password. If the
authentication succeeds, it sends back an Access-Accept message containing the
information of user’s right. If the authentication fails, it returns an Access-Reject
message.
4 The RADIUS client accepts or denies the user according to the returned
authentication result. If it accepts the user, it sends a start-accounting request
(Accounting-Request) to the RADIUS server.
5 The RADIUS server returns a start-accounting response (Accounting-Response) and
starts accounting.
RADIUS client RADIUS serve
1) Username and password
3) Access-Accept /Reject
2) Access-Request
4) Accounting-Request (start)
5) Accounting-Response
6) The subscriber accesses the resources
7) Accounting-Request (stop)
8) Accounting-Response
9) Notification of access termination
Host
To Next Page
Loading...
