Bay Networks RADIUS User manual

Issue 1.0 MAN-RADIUS-REF
RADIUS
REFERENCE MANUAL
Issue 1.0

MAN-RADIUS-REF Issue 1.0
All rights reserved. This document may not in whole or part be copied,
photocopied, reproduced, translated or reduced to any electronic medium or
machine readable form without the prior written permission from Bay
Networks.
The information contained in this manual is believed to be accurate,
however, no responsibility is assumed by Bay Networks for its use, nor for
any infringements of patents or other rights of third parties resulting from
its use.
All trademarks are acknowledged.
1996 Scorpion Logic Ltd. A Bay Networks company

Issue 1.0 MAN-RADIUS-REF
ABOUT THIS MANUAL
Chapter 1 - Introduction
This chapter gives an overview of the features of the RADIUS Server and
provides an introduction to its features and facilities.
Chapter 2 - Tutorial
This chapter gives a step by step guide to the configuration of a sample
Network. It covers the configuration of the RADIUS Server, the Network
Access Server (in this case a Nautica Marlin Router), a small office
Network and a mobile dial-in user.
Chapter 3 - Reference
All RADIUS specific management structure and forms, configuration
parameters and status information are described in detail in this chapter.

MAN-RADIUS-REF Issue 1.0

CONTENTS
Section ……………………………………………… Page
v
Chapter 1 - Introduction
Welcome to Nautica RADIUS 1-1
About This Manual 1-1
Nautica Radius Features 1-2
RADIUS Background 1-2
Theory Of Operation 1-3
Document Conventions 1-4
What You Need 1-6
Hardware 1-6
Software 1-6
Knowledge 1-7
RADIUS Installation 1-8
Chapter 2 - Reference
Introduction 2-1
The Marlin Router and RADIUS 2-1
RADIUS Manager Menu Map 2-2
NAS Types 2-3
Configure NAS Types 2-3
NAS Device Types 2-4
NAS Units 2-5
Configure NAS Units 2-5
NAS Name 2-6
Quality Of Service 2-9
Grade of Service 2-10
Priority Timebands 2-11
Accounts 2-13
Account Information 2-14
Path Type 2-17
Multi-Link Operation (PPP or Nautica Paths) 2-18
Multi-Link Nautica/PPP 2-19
Undistinguished (OEM NAS Connections to RADIUS) 2-20
IP Networking 2-21
RIP Operation 2-22
RIP Type 2-22
Static Route Tables 2-23
IPX Networking 2-24
Outgoing Call Support 2-26
Service 2-27

CONTENTS
Section …………………………………………….. Page
vi
Chapter 2 - Reference (cont.)
Session Parameters 2-27
Accounting 2-28
RADIUS Server 2-29
Nautica Radius Server Menu Map 2-29
File 2-30
RADIUS Server Settings 2-30
Event Log 2-34
Status 2-35
Device Status 2-35
QOS Status 2-36
Account Status 2-37
Account Allocation 2-38
Account Rollover 2-38
Event Log Window 2-39
Breakdown of Account Records 2-39
Example Event Log of an Incoming Connection 2-41
Example Event Log of an Outgoing Connection 2-44
Chapter 3 - Tutorial
Nautica RADIUS Tutorial 3-1
Overview of Sample Test Network 3-2
RADIUS Configuration Tutorial 3-4
RADIUS Installation 3-5
Configuration Procedure 3-6
RADIUS Manager Configuration 3-7
1. Configuring a NAS Type 3-7
2. Configuring a NAS Unit 3-8
3. Configuring the Quality Of Service (QOS) Option 3-10
4. Configuring the Accounts Option 3-14
Configuring the Marlin Router on the HQ Backbone LAN 3-34
Configuring the CLAM Router at the Remote Office 3-47
Configuring the Roving User’s P.C. 3-55

CONTENTS
v

CONTENTS
vi

Introd
u
ction
1-1
INTRODUCTION
Welcome to Nautica RADIUS
Thank you for purchasing Nautica RADIUS as part of your remote access
strategy.
We believe you will be delighted with this product as it is easy to use, and
provides unrivalled Security, Accounting and Quality of Service facilities for
both Intranet and Internet users alike.
ABOUT THIS MANUAL
This reference Manual describes how Nautica RADIUS is installed and
configured with the Nautica family of routers. It should be used in
conjunction with the relevant manuals for each Nautica unit you will be using.
If you wish to use Nautica RADIUS in conjunction with other manufacturers’
products, then the relevant manuals for their products must also be available.

INTRODUCTION
1-2
NAUTICA RADIUS FEATURES
Nautica RADIUS is an Authentication, Authorisation and Accounting system
based on the R.A.D.I.U.S. (Remote Authentication Dial In User Service)
standard which can be adapted to a broad range of different network
requirements of Enterprise, Internet Service Providers (ISPs), Telcos, Value
Added Networks (VANs), Intranets and other service operations. Such
networks may operate in a variety of environments such as:
Public companies providing access to networks for general or specific
usage, such as ISPs, financial information services and scientific
information services for example.
Private Networks for large organisations, where access is provided for
internal operational divisions and perhaps external trading companies
with security and on a chargeable basis. These include: Financial
Services, University Campus, Software Services and large companies
providing remote office, home and Intranet connections for many
departments.
All of these network systems have a common theme :- Remote Access, for the
individual user or the Remote Branch Office, whether via PSTN or ISDN.
RADIUS BACKGROUND
RADIUS consists of two functions, RADIUS Authentication and RADIUS
Accounting. It uses a client/server based security system designed in
accordance with a model of distributed security recommended by the Network
Access Server Working Group of the IETF. RADIUS has been submitted as
an RFC to become an Internet standard, and has been adopted as the protocol
and system of choice by most of the security product manufacturers. RADIUS
is rapidly gaining popularity as an open protocol and architecture with all the
key manufacturers of communications products, as it is both an easy and
efficient means of controlling and accounting for access to backbone
networks.

Introd
u
ction
1-3
THEORY OF OPERATION
RADIUS Authentication in a network acts as a distributed security system
which uses an authentication server to address the issues of Secure Access to
central services through dial-in devices called Network Access Servers
(NAS). By their nature, Dial-In devices are a point of vulnerability for a
network, since anyone can acquire the telephone or ISDN number of the
service, and with the appropriate calling device (such as a modem, ISDN TA
or personal Router), can attempt to gain access to the service.
RADIUS provides a secure mechanism by which NAS devices can
authenticate incoming calls at a central unit before allowing the Account
access to any part of the network. When an Account is granted access, the
RADIUS Server can configure the NAS to customise the services.
Distributed Security allows the separation of the communications process
from the user authentication. This allows a central point of authentication,
configuration, and a single database which many NAS devices can access
without the need to hold the authentication information for all dial-in
Accounts at the NAS (these Accounts can potentially run into several
thousand). The use of this central repository makes RADIUS more secure and
more scaleable than systems based upon many distributed points.
RADIUS authenticates users through a series of communications which take
place from Account (User) to NAS where the RADIUS Client resides, then
from RADIUS Client to RADIUS Server wher the Account Authentication is
processed. The results are then passed onto the RADIUS Client. This
separation of communication activity is another level of security preventing
access at any point to the network in order to maintain its integrity.
As with all standards, RADIUS includes the facility to add extended attributes
so that specific features of different manufacturers’ products may be
supported.
Additionally, RADIUS supports an Accounting mechanism, which records all
connection/disconnection events and bandwidth utilisation by each Account.
Accounting information is reliably delivered by the RADIUS protocol.

INTRODUCTION
1-4
Authentication and Accounting information is keyed using MD5 encryption
algorithms and cannot be modified in transit, since both NAS device and the
RADIUS server validate received packets.
DOCUMENTATION CONVENTIONS
• Mouse-it
Nautica RADIUS only makes use of the left mouse button.
[click]-means press and release once.
[double-click] - means press and release twice in quick succession.
[drag] - means press the button and hold, while moving the object contacted.
• Menu Commands
Menu Commands are in the form of Menu Name/Menu command.
e.g. Select Edit/Undo
• Button Names
Button Names are in the form Button Name.
e.g. Select the OK button
• Key Names
Key Names are in small capitals: ESCAPE.
• Key Combinations and Sequences
A plus sign (+) between keys means press both keys at the same time.

Introd
u
ction
1-5
e.g. Press ALT+ESCAPE
A comma between keys means the keys should be pressed in succession.
e.g. Press ALT, SPACE
What You Type
Anything you should type is in italics.
e.g. Type 123.456.111
Where the typed input is variable then it will be in brackets.
e.g. Type {Your IP Address}
Handy Hints
These are designed to assist you during the process either as reminders or
useful tips and will be in bold italic.
e.g. Note: Always Save your configuration after a change.
Warnings
The insertion of a 1is a caution meaning failure to follow the procedure
could result in a loss of data or connections.

INTRODUCTION
1-6
WHAT YOU NEED
HARDWARE
Nautica RADIUS can be installed on any Windows ’95 platform. We strongly
recommend that it is dedicated to the task of RADIUS to maintain security and
performance across the network.
The recommended dedicated hardware platform for up to 5,000 users is as
follows:
Minimum 486 DX2 66MHz, IBM compatible PC, with 12 Mb RAM.
Ethernet Card.
SVGA (800 x 600) Monitor.
Keyboard.
Mouse.
SOFTWARE
MicrosoftWindows95.
TCP/IP network software.
A Windows 95 installation program is included with Nautica RADIUS.
Note: The addition of Nautica MicroManager (an SNMP based Network
Manager) to this platform could provide an additional window to the
network should you need it.

Introd
u
ction
1-7
KNOWLEDGE
It is recommended that you have at least a basic knowledge of the following
technologies and User Account Information before commencement of
installation procedure
Windows 95.
TCP/IP Address structures.
TCP/IP Addresses for your Network.
If using Novell Netware, Novell IPX and Novell SPX Address structures
and how they apply to your network.
The ISDN Numbers for each of your local and remote installations.
A profile of the people and sites who are using/intending to use the network.
A profile of the data-flow to those sites.
A list of any predefined CHAP Secrets, Nautica Passwords or User Password
to be used during Authentication.
You are now ready to commence installing and configuring your Nautica
RADIUS system. We have also included a TUTORIAL chapter, which
configures the Nautica RADIUS Server in a standard remote access
environment. We strongly recommend that you start off by configuring your
RADIUS Server using this Tutorial first, then progress onto your own specific
configuration.

INTRODUCTION
1-8
RADIUS INSTALLATION
The RADIUS Server and the RADIUS Manager suite of programs is provided
on two 3.5"Floppy Disks. These are labelled “Disk 1” and “Disk 2”.
1. Place the 3.5"Floppy Disk labelled Disk 1 into the A Drive of the
Windows 95 PC.
2. Select the Start option on the Windows 95 Task Bar by placing the mouse
pointer over the “Start” Button and clicking the left mouse button.
3. [Click] the Run option.
4. Type A:\Setup.exe in the “Open” box.
5. [Click] the OK Button.
6. Follow the instructions given in the Setup Windows and amend any
settings as necessary.
7. When the Setup program is complete the “Nautica RADIUS” Window is
displayed. [Double-click] the red RADIUS_M icon in the “Nautica
RADIUS” Window. This runs the RADIUS_M program.
8. When the “RADIUS Manager” window appears [click] the Minimise
Button. This will place the RADIUS Manager Button on the Task Bar.
9. [Double click] the green RADIUS_S icon in the “Nautica RADIUS”
Window. This runs the RADIUS_S program
10. When the “RADIUS Server” window appears [click] the Minimise
Button. This will place the RADIUS Server Button on the Task Bar.
11. [Click] the Close Button on the “Nautica RADIUS” Window.

Introd
u
ction
1-9
NAUTICA RADIUS FILES
The Files you should now have installed on your hard drive are as follows:-
Two executable files :-
1) RADIUS_S.EXE
This is the Server program which communicates with the NAS RADIUS
Client software. It validates the users with the details stored in the
RADIUS.LST file, which is created when RADIUS_M is run.
2) RADIUS_M.EXE
This is the RADIUS Manager program. This provides the configuration for
the NASs and Users. It also generates the User database as new users are
configured. The RADIUS Manager is generally only used when adding new
User or NAS configurations or when making changes to existing Users and
NASs. As such it automatically reloads information changes to the
RADIUS.LST file when changes are made.
Other Files installed are:
CW3215.DLL BIDS45.DLL
BC450RTL.DLL BIDS45F.DLL
BWCC.DLL BWCC32.DLL
OWL250F.DLL OWL250.DLL
If the RADIUS.LST file does not already exist one is automatically created
when the RADIUS_M.EXE program is run.

INTRODUCTION
1-10

REFERENCE
2-1
INTRODUCTION
The Bay Networks RADIUS implementation is such that the RADIUS Server
functionality and the Account and NAS configuration are carried out using
separate executable programs, RADIUS_M.EXE and RADIUS_S.EXE. This
allows configuration changes to be made without having to halt the RADIUS
Server, providing continuous online network operation.
The initial and day to day configuration is carried out by the RADIUS_M
program (RADIUS Manager), while the actual RADIUS Server function of
Authentication, Access Control and Accounting is performed by the
RADIUS_S program.
The Reference Section is arranged in such a way that it guides the reader
through the RADIUS Manager Menus and gives a brief description of each
selectable parameter and their available options. The Reference section then
follows describes the Menus and options provided by the RADIUS Server
program.
It should be noted that an “Account” is almost equivalent to a “Path” on a
Nautica Router, and as a result all common variables use the same name. It is
recommended that a Marlin or CLAM Version 3 Router Reference Manual is
read in conjunction with this RADIUS Reference Manual to obtain an all
round understanding of the common variables used.
THE MARLIN ROUTER AND RADIUS
The Nautica family, particularly the Marlin need to be configured for
RADIUS operation prior to installation. To carry out this configuration,
please see the relevant section of the Nautica Manual.
For other manufacturer’s products please refer to the relevant manual and
configure them accordingly.
Note: Marlins configured for use with a RADIUS Server start with no Paths
configured. All Paths are downloaded using the RADIUS protocol.

REFERENCE
2-2
This generally also applies to other manufacturer’s products, where the
RADIUS protocol will download the paths using the profiles input into
RADIUS for that specific product.
RADIUS MANAGER MENU MAP
Nautica RADIUS Manager Menu Map
Priority Timebands
Grade Of Service
Quality of Service
Multi-Link Nautica
Multi-link PPP
Undistinguished
Path Type
IP Path
IP Networking
IPX Path
IPX Netwroking
Session Parameters
Service
Account Information
Remote Accounts
Account
NAS DeviceTypes
Configure NAS Types
NAS Types
NAS Name
Configure NAS Units
NAS Units Key Generator
RADIUS MANAGER