RADIUS server feature of the device
Enable the RADIUS server feature of the device to work with RADIUS clients for user authentication and authorization. The device can act as a dedicated RADIUS server or as both a RADIUS server and a RADIUS client at the same time.
The RADIUS server feature provides for flexible networks with less cost. As shown in Figure 11, Device A provides RADIUS server functions at the distribution layer; Device B and Device C are configured with RADIUS schemes to implement user authentication and authorization at the access layer.
Figure 10: Network diagram
The RADIUS server feature supports the following operations:
Manages RADIUS user data, which is generated from local user information and includes user name, password, description, authorization ACL, authorization VLAN, and expiration time.
Allows you to add, modify, and delete RADIUS clients. A RADIUS client is identified by the IP address and includes attribute information such as the shared key. The RADIUS server feature processes authentication requests only from the recorded RADIUS clients and ignores requests from unknown clients.
Authenticates and authorizes users of the network access type. The server does not provide accounting.
When the RADIUS server receives a RADIUS packet, it performs the following actions:
Verifies that the packet is sent from a recorded RADIUS client.
Verifies the packet with the shared key.
Verifies that the user account exists, the password is correct, and other attributes meet the requirements (for example, the account is in the validity period).
Determines the authentication result and authorizes specific privileges to the authenticated user.
The RADIUS server feature of the device has the following restrictions:
The authentication port is fixed at UDP 1812 and cannot be modified.
The feature is supported on IPv4 networks, but not on IPv6 networks.
The server provides only PAP and CHAP authentication methods.
User names sent to the RADIUS server cannot include a domain name.