Design Reference

policy to provide access. A lower precedence takes higher priority if you use multiple policies.
Preference 120 has priority over preference 128.
RADIUS authentication
You can enforce access control by using Remote Authentication Dial-in User Service (RADIUS).
RADIUS provides a high degree of security against unauthorized access and centralizes the
knowledge of security access based on a client and server architecture. The database within the
RADIUS server stores pertinent information about clients, users, passwords, and access privileges
including the use of the shared secret.
When the switch acts as a Network Access Server, it operates as a RADIUS client. The switch is
responsible for passing user information to the designated RADIUS servers. Because the switch
operates in a LAN environment, it allows user access through Telnet, rlogin, and console logon.
You can configure a list of up to 10 RADIUS servers on the switch. If the first server is unavailable,
VSP 4000 tries the second, and so on, until it establishes a successful connection.
RADIUS authentication supports: WEB, CLI, or SNMP. You can configure a list of up to 10 RADIUS
servers for all three methods combined. If you configure six servers for SNMP, you can configure
four servers for the other methods.
You can use the RADIUS server as a proxy for stronger authentication (see the following figure),
such as:
• SecurID cards
• Kerberos
• other systems like Terminal Access Controller Access-Control System Plus (TACACS+)
Figure 57: RADIUS server as proxy for stronger authentication
You must configure each RADIUS client to contact the RADIUS server. When you configure a client
to work with a RADIUS server, complete the following configurations:
• Enable RADIUS.
• Provide the IP address of the RADIUS server.
• Ensure that the shared secret matches what is defined in the RADIUS server.
• Provide the attribute value.
• Provide the use-by value.
The use-by value can be CLI, SNMP, or IGMP, or EAPoL.
• Indicate the order of priority in which the RADIUS server is used. (Order is essential when
more than one RADIUS server exists in the network.)
• Specify the User Datagram Protocol (UDP) port that the client and server use during the
authentication process. The UDP port between the client and the server must have the same or
System and network stability and security
122 Network Design Reference for Avaya VSP 4000 Series December 2014
Comments? [e-mail]