8
Authentication
155
RADIUS architecture
The
RADIUS
protocol
is
based
on
a
client/server
architecture.
The
SEG
acts
as
the
client
of
the
RADIUS
server,
creating
and
sending
requests
to
a
dedicated
server(s).
In
RADIUS
terminology
the
security
gateway
acts
as
the
Network
Access
Server
(NAS).
For
user
authentication,
the
RADIUS
server
receives
authentication
requests
and
then
verifies
the
user’s
credentials
by
consulting
its
database.
It
then
returns
either
an
“accept”
or
“reject”
reply
to
the
requesting
client.
Configuring RADIUS servers
RADIUS
servers
are
configured
as
separate
objects
in
the
SEG.
A
RADIUS
server
object’s
properties
are:
•
Name
A
suitable
logical
name
for
the
object.
•
IPAddress
The
IP
address
of
the
server.
This
could
be
an
IP
address
object
from
the
SEG
address
book.
•
Port
The
port
used
for
the
connection
by
the
SEG.
This
default
value
is
1812
.
•
RetryTimeout
This
is
the
length
of
time
in
milliseconds
after
which
a
RADIUS
request
will
have
assumed
to
fail
and
a
retry
is
attempted.
This
value
cannot
be
less
that
500
with
no
upper
limit.
The
default
value
is
2000
.
•
NumRetries
When
a
RADIUS
request
times
out,
the
request
is
retried.
This
happens
for
NumRetries
times.
The
retry
minimum
is
1
and
the
maximum
is
10
.
The
default
is
3
.
•
Shared
Secret
To
provide
request
security,
a
common
Shared
Secret
is
configured
on
both
the
RADIUS
client
and
the
server.
This
secret
enables
encryption
of
the
messages
sent
from
the
RADIUS
client
to
the
server
and
is
commonly
configured
as
a
relatively
long
text
string.
The
string
can
contain
up
to
100
characters
and
is
case
sensitive.
RADIUS
uses
PPP
to
transfer
username/password
requests
between
client
and
RADIUS
server,
as
well
as
using
PPP
authentication
schemes
such
as
PAP
and
CHAP.
RADIUS
messages
are
sent
as
UDP
messages
via
UDP
port
1812
.
•
NAS
‐
Identifier
This
value
is
required
when
sending
requests
to
some
RADIUS
servers.
