| 4.4 |  | AAA Servers Overview and Configuration |
| 4.4.2 |  | Introduction to RADIUS |

| Overview Remote Authentication Dial-In User Service (RADIUS) is an alternative to TACACS+ and is important to network administrators. RADIUS is an access server AAA protocol developed by Livingston Enterprises, Inc (now part of Lucent Technologies). It is a system of distributed security that secures remote access to networks and protects network services against unauthorized access. RADIUS is comprised of three components:

- Protocol with a frame format that uses UDP/IP
- Server
- Client

The server runs on a central computer, typically at the customer’s site, while the clients reside in the dialup access servers and can be distributed throughout the network. Cisco incorporated the RADIUS client into Cisco IOS, starting with IOS release 11.1.

Client/server model
A network access server (NAS) operates as a client of RADIUS . The client is responsible for passing user information to designated RADIUS servers, and then acting on the response that is returned. RADIUS servers are responsible for receiving user connection requests, authenticating the user, and then returning all configuration information necessary for the client to deliver service to the user. The RADIUS servers can act as proxy clients to other kinds of authentication servers.

The RADIUS server can either use a local user database or can be integrated to use a Windows database or LDAP directory to validate the username and password.

More information on the RADIUS protocol can be found in RFC2865 and 2868.

Network security
Transactions between the client and RADIUS server are authenticated using a shared secret, which is never sent over the network. In addition, any user passwords are sent encrypted between the client and RADIUS server, to eliminate the possibility that someone snooping on an unsecured network could determine a user password.

Flexible authentication mechanisms
The RADIUS server supports a variety of methods to authenticate a user. When it is provided with the username and original password given by the user, it can support PPP, PAP, CHAP, or MS-CHAP, UNIX login, and other authentication mechanisms.

Configuration
RADIUS configuration is a three-step process:

Step 1 Configure communication between the router and the RADIUS server.

Step 2 Use the AAA global configuration commands to define method lists containing RADIUS to define authentication and authorization methods. Method lists include the following keywords :

- enable - Uses the enable password for authentication
- line - Uses the line password for authentication
- local - Uses the local username database for authentication
- none - Uses no authentication
- radius - Use RADIUS authentication
- tacacs+ - Uses TACACS+ authentication

The administrator can create AAA accounting for RADIUS connections and with TACACS+.

Step 3 Use line and interface commands to apply the defined method lists to the appropriate lines and interfaces.

| Media Activity Demonstration Activity: RADIUS Configuration Overview In this activity, students will learn about the RADIUS protocol.