System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

RADIUS protocol

Want to summarize with AI?

Log in

Explains how the RADIUS client/server protocol supports Cisco IOS XR AAA by centralizing authentication and accounting requests for remote network access.


A RADIUS protocol is a distributed client/server protocol that

  • secures network access by sending authentication and accounting requests from Cisco IOS XR routers to a central RADIUS server

  • enables RADIUS clients on Cisco routers to forward user authentication and network-service access information to a central server, and

  • operates with other AAA security protocols, including TACACS+, Kerberos, and local username lookup.

Additional reference information

RADIUS is a distributed client/server system that secures networks against unauthorized access. In the Cisco implementation, RADIUS clients run on Cisco routers and send authentication and accounting requests to a central RADIUS server that contains all user authentication and network service access information.

RADIUS is a fully open protocol, distributed in source code format, that can be modified to work with any security system currently available on the market.

Cisco supports RADIUS under its AAA security paradigm. RADIUS can be used with other AAA security protocols, such as TACACS+, Kerberos, and local username lookup.

Note

RADIUS is supported on all Cisco platforms, but some RADIUS-supported features run only on specified platforms.

RADIUS has been implemented in a variety of network environments that require high levels of security while maintaining network access for remote users.

Use RADIUS in the following network environments that require access security:

  • Networks with multiple-vendor access servers, each supporting RADIUS. For example, access servers from several vendors use a single RADIUS server-based security database. In an IP-based network with multiple vendors' access servers, dial-in users are authenticated through a RADIUS server that has been customized to work with the Kerberos security system.

  • Turnkey network security environments in which applications support the RADIUS protocol, such as in an access environment that uses a "smart card" access control system. In one case, RADIUS has been used with Enigma security cards to validate users and grant access to network resources.

  • Networks already using RADIUS. You can add a Cisco router with RADIUS to the network. This might be the first step when you make a transition to a Terminal Access Controller Access Control System Plus (TACACS+) server.

  • Networks in which a user must access only a single service. Using RADIUS, you can control user access to a single host, utility such as Telnet, or protocol such as Point-to-Point Protocol (PPP). For example, when a user logs in, RADIUS identifies this user as having authorization to run PPP using IP address 10.2.3.4 and the defined access list is started.

  • Networks that require resource accounting. You can use RADIUS accounting independent of RADIUS authentication or authorization. The RADIUS accounting functions allow data to be sent at the start and end of services, indicating the amount of resources (such as time, packets, bytes, and so on) used during the session. An Internet service provider (ISP) might use a freeware-based version of RADIUS access control and accounting software to meet special security and billing needs.

  • Networks that support preauthentication. Using the RADIUS server in your network, you can configure AAA preauthentication and set up the preauthentication profiles. Preauthentication enables service providers to better manage ports using their existing RADIUS solutions and to efficiently manage the use of shared resources to offer differing service-level agreements.


RADIUS unsuitable network security situations

RADIUS is not suitable in the following network security situations:

  • Multiprotocol access environments. RADIUS does not support the following protocols:

    • AppleTalk Remote Access (ARA)

    • NetBIOS Frame Control Protocol (NBFCP)

    • NetWare Asynchronous Services Interface (NASI)

    • X.25 PAD connections

  • Router-to-router situations: RADIUS does not provide two-way authentication. RADIUS can be used to authenticate from one router to a router other than a Cisco router if that router requires RADIUS authentication.

  • Networks using a variety of services: RADIUS generally binds a user to one service model.

Use this reference to identify environments where RADIUS limitations affect protocol support, router-to-router authentication, or multi-service authorization.

Choose an alternate AAA design when the environment needs two-way router authentication, unsupported access protocols, or service models that RADIUS cannot represent.


How RADIUS authentication works

RADIUS authentication begins when a user logs in to an access server by providing a username and password. The access server encodes the credentials and forwards them to the RADIUS server.

Summary

The key components involved in the process are:

  • User: Provides a username and password to initiate authentication.

  • Access server: Sends the submitted credentials to the RADIUS server.

  • RADIUS server: Validates the credentials and determines access and service authorization.

RADIUS authentication is a network access control process in which a user logs in to an access server, submits credentials, and receives authorization from a RADIUS server based on those credentials and additional data returned.

Workflow

These stages describe how RADIUS authentication works.

  1. Credential Entry: The user is prompted for and enters a username and password.

  2. Transmission: The access server sends the username and encrypted password to the RADIUS server.

  3. Server Response: The RADIUS server responds with one of the following:

    • Access-Accept: The user is authenticated.

    • Access-Reject: The user is denied access or prompted to re-enter credentials.

    • Challenge: The server issues a challenge to collect additional information from the user.

    • Change Password: The server asks the user to select a new password.

  4. Authorization Data: Along with the Accept or Reject response, additional data for XR EXEC mode or network authorization is included:

    • Services the user can access (Telnet, rlogin, local-area transport, PPP, SLIP, or XR EXEC mode).

    • Connection parameters (host or client IP address, access list, user timeouts).

  5. Completion: RADIUS authentication must succeed before RADIUS authorization is used.

Result

After RADIUS authentication succeeds, additional response data can authorize XR EXEC mode or network services.