Content

| 9.7 |  | Authentication, Authorization, and Accounting |
| 9.7.3 |  | RADIUS |

The RADIUS protocol is a client/server protocol, and was developed by Livingston Enterprises as an authentication and accounting protocol for use with access servers. RADIUS is specified in RFCs 2865, 2866, and 2868. Even though TACACS+ offers more flexible AAA configurations, RADIUS is a popular AAA solution. This is because it is an open standard, it typically uses fewer CPU cycles and is less memory intensive than the proprietary TACACS+. RADIUS is currently the only security protocol supported by emerging wireless authentication protocols.

Communication between a network device and a RADIUS server is based on the User Datagram Protocol (UDP). Generally, the RADIUS protocol is considered a connectionless service. Issues related to server availability, retransmission, and timeouts are handled by the RADIUS-enabled devices rather than by the transmission protocol. Typically, the RADIUS protocol will retry a transmission if a response is not received within a specified timeout period.

The RADIUS client is typically a network device such as a network access server (NAS), a LAN switch, or a network router. The RADIUS server is usually a daemon process running on a UNIX machine or a service running on a Windows machine. The client passes user information to designated RADIUS servers, and waits for a response. The RADIUS server receives the user connection request, authenticates the user, and returns the configuration information, accept, reject or challenge, necessary for the client to deliver service to the user. A RADIUS server can also act as a proxy client to other RADIUS servers and other kinds of authentication servers.

Today, the emerging Extensible Authentication Protocol (EAP) relies on RADIUS services. EAP with RADIUS makes it possible to use various authentication methods on a network that are not supported by the NAS. This means customers can use standard authentication mechanisms, such as random key tokens, smart cards and public keys, to strengthen end-user and device-authenticated access to networks.

Variants of EAP, such as Cisco Lightweight Extensible Authentication Protocol (LEAP) and the standards-based Protected Extensible Authentication Protocol (PEAP), provide dynamic per-user, per-session Wired Equivalent Privacy (WEP) key enhancements to mitigate a variety of wireless network attacks. As more network professional turn to EAP, LEAP, and PEAP to better secure their networks, RADIUS deployments will increase.