User`s guide

Setting Up Pipeline Security
Using security cards
Pipeline User’s Guide Preliminary January 30, 1998 7-19
For the Pipeline to place calls to a NAS at a secure site, it needs the appropriate
Connection profile specifying a token-based authentication mode.
The authentication mode configured in the Pipeline affects how the token
passwords are transmitted and how the dial-in user is affected by channels being
added to an established session.
The Pipeline requests the authentication mode with which it is configured, but the
RADIUS daemon and user profile accessed by the answering NAS determine
which mode will actually be used.
Requesting PAP-TOKEN mode
PAP-TOKEN is the default authentication mode used when the RADIUS profile
has a password of ACE or Safeword. It is an extension of PAP authentication.
When PAP-TOKEN mode is in use, the dynamic password (or code) supplied by
the user’s security card is sent in the clear (via PAP). This does not cause a
serious security risk because the password expires every 60 seconds (or at some
other very short interval of time).
The response to the initial password challenge authenticates the base channel of
the call. If bandwidth requirements cause another channel to come up, the user is
challenged for a password whenever a channel is added to a call.
Parameters used to configure the calling unit for PAP-TOKEN are set in the
following menus:
Ethernet
Connections
profile
Encaps options...
Send Auth=PAP-TOKEN
Send PW=*SECURE*
The Send Auth parameter specifies the authentication mode requested by the
caller (PAP-TOKEN). The Send PW password is sent as part of the initial session
negotiation. If the session then presents a password challenge, the user enters the
password obtained from the security card.