Datasheet

9-8
Cisco ONS 15454 SDH Reference Manual, R7.0
October 2008
Chapter 9 Security
9.3.2 Audit Trail Capacities
• Message Type—Denotes if the event is Success/Failure type
• Message Details—A description of the change
9.3.2 Audit Trail Capacities
The system is able to store 640 log entries.When this limit is reached, the oldest entries are overwritten
with new events.
When the log server is 80 percent full, an AUD-LOG-LOW condition is raised and logged (by way of
CORBA/CTC).
When the log server reaches a maximum capacity of 640 entries and begins overwriting records that were
not archived, an AUD-LOG-LOSS condition is raised and logged. This event indicates that audit trail
records have been lost. Until the user off-loads the file, this event occurs once regardless of the amount
of entries that are overwritten by the system. To export the audit trail log, refer to the
Cisco ONS 15454 SDH Procedure Guide.
9.4 RADIUS Security
Users with Superuser security privileges can configure nodes to use Remote Authentication Dial In User
Service (RADIUS) authentication. Cisco Systems uses a strategy known as authentication,
authorization, and accounting (AAA) for verifying the identity of, granting access to, and tracking the
actions of remote users.
9.4.1 RADIUS Authentication
RADIUS is a system of distributed security that secures remote access to networks and network services
against unauthorized access. RADIUS comprises three components:
• A protocol with a frame format that utilizes User Datagram Protocol (UDP)/IP
• A server
• A client
The server runs on a central computer typically at the customer's site, while the clients reside in the
dial-up access servers and can be distributed throughout the network.
An ONS 15454 SDH node operates as a client of RADIUS. The client is responsible for passing user
information to designated RADIUS servers, and then acting on the response that is returned. RADIUS
servers are responsible for receiving user connection requests, authenticating the user, and returning all
configuration information necessary for the client to deliver service to the user. The RADIUS servers
can act as proxy clients to other kinds of authentication servers. Transactions between the client and
RADIUS server are authenticated through the use of a shared secret, which is never sent over the
network. In addition, any user passwords are sent encrypted between the client and RADIUS server. This
eliminates the possibility that someone snooping on an unsecured network could determine a user's
password. Refer to the Cisco ONS 15454 SDH Procedure Guide for detailed instructions for
implementing RADIUS authentication.