Managing Radius Authentication - Siemens RUGGEDCOM ROX II User Manual

RUGGEDCOM ROX II
CLI User Guide
Section 4.8

Managing RADIUS Authentication

RADIUS is a UDP-based protocol used for carrying authentication, authorization and configuration information
between a Network Access Server (NAS) that desires to authenticate its links and a shared authentication server.
It provides centralized authentication and authorization for network access.
RADIUS is also widely used in conjunction with the IEEE 802.1x standard for port security using the Extensible
Authentication Protocol (EAP).
NOTE
For more information about the RADIUS protocol, refer to
For more information about the Extensible Authentication Protocol (EAP), refer to
tools.ietf.org/html/rfc3748].
IMPORTANT!
The user authentication mode must be set to radius_local for users to be authenticated against the
RADIUS server. For more information about setting the authentication mode, refer to
"Setting the User Authentication
IMPORTANT!
RADIUS messages are sent as UDP messages. The switch and the RADIUS server must use the
same authentication and encryption key.
In a RADIUS access request, the following attributes and values are typically sent by the RADIUS client to the
RADIUS server:
Attribute
User-Name
User-Password
Service-Type
Vendor-Specific
A RADIUS server may also be used to authenticate access on ports with 802.1X security support. When this is
required, the following attributes are sent by the RADIUS client to the RADIUS server:
Attribute
User-Name
NAS-IP-Address
Service-Type
Frame-MTU
a
EAP-Message
a
EAP-Message is an extension attribute for RADIUS, as defined by
Managing RADIUS Authentication
Mode".
Value
{ Guest, Operator, Admin }
{ password }
1
Vendor-ID: 15004
Type: 1
Length: 11
String: RuggedCom
Value
{ The username as derived from the client's EAP identity response }
{ The Network Access Server IP address }
2
1500
{ A message(s) received from the authenticating peer }
RFC 2869.
RFC 2865 [http://tools.ietf.org/html/rfc2865].
Chapter 4
System Administration
RFC 3748 [http://
Section 4.4,
175