When dialing-in using the PPP protocol (Point-to-Point protocol), RADIUS can be used to check client access authorizations. A client can dial-in to the network from anywhere. The resulting data transmission between client and authenticator is encrypted.
The configuration is carried out in LANconfig under .
- Radius server
-
When authenticating using RADIUS, the user administration and authentication tasks are passed on to a RADIUS server.
- Disabled: The functionality of RADIUS is disabled and no requests are forwarded to the RADIUS server (default).
- Operating: The functionality of RADIUS is enabled and requests may be forwarded to the configured RADIUS server. Depending on the setting, other sources may be used for the authentication process (e.g. PPP list).
- Exclusive: RADIUS functionality is enabled and the authentication process is run exclusively by RADIUS.
- Protocols
- The available protocols are the UDP-based RADIUS and the TCP-based RADSEC. See also RADSEC.
- Address
- Enter the IP address (IPv4, IPv6) or the hostname of the RADIUS server used for central user management.
- Server port
- Specify here the port used for communication to your RADIUS server (default: 1,812).
- Source address
- The device automatically determines the correct source IP address for the destination network. To use a fixed source IP address instead, enter it symbolically or directly here.
- Attribute values
-
LCOS facilitates the configuration of the RADIUS attributes used to communicate
with a RADIUS server (for authentication and accounting).
The attributes are specified in a semicolon-separated list of attribute numbers or names along with a corresponding value in
the following form:
<Attribute_1>=<Value_1>;<Attribute_2>=<Value_2>
As the number of characters is limited, the name can abbreviated. The abbreviation must be unique, however. Examples:
- NAS-Port=1234 is not allowed, because the attribute is not unique (NAS-Port, NAS-Port-Id or NAS-Port-Type).
- NAS-Id=ABCD is allowed, because the attribute is unique (NAS-Identifier).
- %n
- Device name
- %e
- Serial number of the device
- %%
- Percent sign
- %{name}
- Original name of the attribute as transferred by the RADIUS application. This allows attributes to be set with the original RADIUS attributes, for example: Called-Station-Id=%{NAS-Identifier} sets the attribute Called-Station-Id to the value with the attribute NAS-Identifier.
- Secret
- Specify here the key to be used for coding data. The key must also be configured on the RADIUS server.
- Message Auth. required
- Defines whether the presence of the message authenticator attribute in RADIUS messages is enforced on the client side. The client side is the side that receives the RADIUS accept/fail.
- PPP operation
-
A RADIUS server may be used for the authentication process when dialing-in using PPP.
- Disabled: PPP clients are not authenticated using RADIUS. They are checked exclusively using the PPP list (default).
- Operating: RADIUS authentication for PPP clients is enabled. User data supplied by clients is first checked using the PPP list. If no matching entry is found in the PPP list, the client is checked by the RADIUS server. Authentication is successful if the PPP list check or RADIUS server check returns as positive.
- Exclusive: RADIUS authentication for PPP clients is enabled. User data supplied by clients is checked exclusively by the RADIUS server. In this mode, solely the advanced settings of the PPP list for the user are interpreted (e.g. check for PAP/CHAP – or the allowed protocols like IP).
