Web Management Guide

Chapter 11 | Security Measures
AAA Authentication, Authorization and Accounting
– 238 –
3. Click Apply.
Figure 134: Configuring the Authentication Sequence
Configuring Remote
Logon Authentication
Servers
Use the Security > AAA > Server page to configure the message exchange
parameters for RADIUS or TACACS+ remote access authentication servers.
Remote Authentication Dial-in User Service (RADIUS) and Terminal Access
Controller Access Control System Plus (TACACS+) are logon authentication
protocols that use software running on a central server to control access to RADIUS-
aware or TACACS-aware devices on the network. An authentication server contains
a database of multiple user name/password pairs with associated privilege levels
for each user that requires management access to the switch.
Figure 135: Authentication Server Operation
RADIUS uses UDP while TACACS+ uses TCP. UDP only offers best effort delivery,
while TCP offers a more reliable connection-oriented transport. Also, note that
RADIUS encrypts only the password in the access-request packet from the client to
the server, while TACACS+ encrypts the entire body of the packet.
Command Usage
◆ If a remote authentication server is used, you must specify the message
exchange parameters for the remote authentication protocol. Both local and
remote logon authentication control management access via the console port,
web browser, or Telnet.
◆ RADIUS and TACACS+ logon authentication assign a specific privilege level for
each user name/password pair. The user name, password, and privilege level
must be configured on the authentication server. The encryption methods
used for the authentication process must also be configured or negotiated
Web
Telnet
RADIUS/
TACACS+
server
console
1. Client attempts management access.
2. Switch contacts authentication server.
3. Authentication server challenges client.
4. Client responds with proper password or key.
5. Authentication server approves access.
6. Switch grants management access.