RADIUS Overview RADIUS is a distributed client/server system that secures networks against unauthorized access. RADIUS clients run on supported Cisco devices. Clients send authentication requests to a central RADIUS server, which contains all user authentication and network service access information. Use RADIUS in these network environments that require access security: • Networks with multiple-vendor access servers, each supporting RADIUS. For example, access servers from several vendors use a single RADIUS server-based security database.
In an IP-based network with multiple vendors’ access servers, dial-in users are authenticated through a RADIUS server that has been customized to work with the Kerberos security system. • Turnkey network security environments in which applications support the RADIUS protocol, such as in an access environment that uses a smart card access control system. • Networks already using RADIUS. You can add a Cisco device containing a RADIUS client to the network. This might be the first step when you make a transition to a TACACS+ server. See the illustration: Transitioning from RADIUS to TACACS+ Services below. Figure 1:
Transitioning from RADIUS to TACACS+ Services • Network in which the user must only access a single service. Using RADIUS, you can control user access to a single host, to a single utility such as Telnet, or to the network through a protocol such as IEEE 802.1x. For more information about this protocol, see the chapter Configuring IEEE 802.1x Port-Based Authentication . • Networks that require resource accounting. You can use RADIUS accounting independently of RADIUS authentication or authorization. The RADIUS accounting functions allow data to be sent at the start and end of services, showing the amount of resources (such as time, packets, bytes, and so forth) used during the session.
An Internet service provider might use a freeware-based version of RADIUS access control and accounting software to meet special security and billing needs. RADIUS Operation When a user attempts to log in and authenticate to a device that is access controlled by a RADIUS server, these events occur: 1. The user is prompted to enter a username and password. Configuring RADIUS RADIUS Overview Configuring RADIUS 3