Cisco CRS-1 - Carrier Routing System Router Configuration Guide

Configuring AAA Services on Cisco IOS XR Software
How to Configure AAA Services
SC-18
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
OL-20382-01
Network Security Situations in Which RADIUS is Unsuitable
RADIUS is not suitable in the following network security situations:
• Multiprotocol access environments. RADIUS does not support the following protocols:
– AppleTalk Remote Access (ARA)
– NetBIOS Frame Control Protocol (NBFCP)
– NetWare Asynchronous Services Interface (NASI)
– X.25 PAD connections
• Router-to-router situations. RADIUS does not provide two-way authentication. RADIUS can be
used to authenticate from one router to a router other than a Cisco router if that router requires
RADIUS authentication.
• Networks using a variety of services. RADIUS generally binds a user to one service model.
RADIUS Operation
When a user attempts to log in and authenticate to an access server using RADIUS, the following steps
occur:
1. The user is prompted for and enters a username and password.
2. The username and encrypted password are sent over the network to the RADIUS server.
3. The user receives one of the following responses from the RADIUS server:
a. ACCEPT—The user is authenticated.
b. REJECT—The user is not authenticated and is prompted to reenter the username and password,
or access is denied.
c. CHALLENGE—A challenge is issued by the RADIUS server. The challenge collects additional
data from the user.
d. CHANGE PASSWORD—A request is issued by the RADIUS server, asking the user to select
a new password.
The ACCEPT or REJECT response is bundled with additional data used for EXEC or network
authorization. You must first complete RADIUS authentication before using RADIUS authorization.
The additional data included with the ACCEPT or REJECT packets consists of the following:
• Services that the user can access, including Telnet, rlogin, or local-area transport (LAT) connections,
and PPP, Serial Line Internet Protocol (SLIP), or EXEC services.
• Connection parameters, including the host or client IP address, access list, and user timeouts.
How to Configure AAA Services
To configure AAA services, perform the tasks described in the following sections.
• Configuring Task Groups, page SC-19 (required)
• Configuring User Groups, page SC-21 (required)
• Configuring Users, page SC-23 (required)
• Configuring Router to RADIUS Server Communication, page SC-25 (optional)
• Configuring RADIUS Dead-Server Detection, page SC-29 (optional)

Cisco CRS-1 - Carrier Routing System Router Specifications

General

Brand	Cisco
Model	CRS-1 - Carrier Routing System Router
Category	Network Router
Language	English