This document gives an overview of RADIUS (Remote Authentication Dial-In User Service), explains how the Nx Networks implementation of RADIUS works, and lists the steps for setting up RADIUS for use with GTSecure. It includes the following sections:
RADIUS Overview
How RADIUS Works
Setting up RADIUS
RADIUS Overview
RADIUS is a security system that uses a client-server approach to authenticate remote users. RADIUS authenticates users through a series of challenges and responses that the client relays between the server and the user.
In the Nx Networks implementation of RADIUS, the server resides on a UNIX workstation and the GTSecure router acts as the RADIUS client. You can locate the server locally or remotely from the client.
The user uses a token device that generates responses to the challenges that the RADIUS server sends. This implementation of RADIUS works with the CRYPTOCard©, which is produced by the CRYPTOCard Corporation.
The RADIUS server has a collection of databases that contain information about the
The GTSecure client relays challenges from the server to the user, and it relays responses back from the user to the server. You configure GTSecure with information about the RADIUS server. You can set up and prioritize up to four RADIUS servers. If GTSecure cannot reach the first server, it sends the authentication request to an alternate server.You can set up a shared secret between the RADIUS server and the GTSecure client so that they can authenticate each other. This secret is based on the RSA Data Security, Inc. MD5 Message-Digest Algorithm. Using a secret prevents an unauthorized intruder from responding to authentication requests.
Communication Between the Router and the User
You can set up the router so that the user who is authenticating can connect to the router using either Telnet or HTTP. The advantages to using HTTP over Telnet are:
The router allows only two active Telnet sessions at one time versus 128 active HTTP sessions at one time. Because router administrators are likely to use Telnet to configure or monitor the router, one of the available Telnet sessions could potentially be in use for an extended period.
Some Internet Service Providers (ISPs) do not offer Telnet services.
Types of Challenges and Responses
You can set up the CRYPTOCard and the RADIUS server to work either in challenge-response mode or in reduced-entry mode.
Challenge-response mode uses a random challenge for each authentication transaction. The user must enter this challenge into their CRYPTOCard and the CRYPTOCard calculates a response.
In reduced-entry mode, the server and the CRYPTOCard both save the response from the previous authentication transaction and use it to compute a default challenge for the next transaction. In this way, the CRYPTOCard can anticipate the challenge, and the user does not have to enter the challenge into the CRYPTOCard. The user simply presses the ENT key.
For HTTP users, GTSecure encrypts the name and password and sends them to the RADIUS server in an Authentication Request packet.
For Telnet users, GTSecure checks if the login name is in the router's Administrator database. If the name is not in the database, GTSecure encrypts the name and password and sends them to the RADIUS server in an Authentication Request packet.
If at any point during the authentication process conditions are not met, the RADIUS server sends an Authentication Reject to GTSecure and GTSecure denies access to the network.
Setting up RADIUS
Setting up a RADIUS configuration involves the following: