Users Guide

RADIUS over TLS authentication
Traditional RADIUS-based user authentication runs over UDP and uses the MD5 message-digest algorithm for secure
communications. To provide enhanced security in RADIUS user authentication exchanges, RFC 6614 defines the RADIUS over
Transport Layer Security (TLS) protocol. RADIUS over TLS secures the entire authentication exchange in a TLS connection and
provides additional security by:
● Performing mutual authentication of a client and server using public key infrastructure (PKI) certificates
● Encrypting the entire authentication exchange so that neither the user ID nor password is vulnerable to discovery
RADIUS over TLS authentication requires that X.509v3 PKI certificates are configured on a certification authority (CA) and
installed on the switch. For more information, including a complete RADIUS over TLS use case, see X.509v3 certificates.
NOTE: If you enable FIPS using the crypto fips enable command, RADIUS over TLS operates in FIPS mode. In FIPS
mode, RADIUS over TLS requires that a FIPS-compliant certificate and key pair are installed on the switch. In non-FIPS
mode, RADIUS over TLS requires that a certificate is installed as a non-FIPS certificate. For information about how to install
FIPS-compliant and non-FIPS certificates, see Request and install host certificates.
To configure RADIUS over TLS user authentication, use the
radius-server host tls command. Enter the server IP
address or host name, and the shared secret key used to authenticate the OS10 switch on a RADIUS host. You must enter the
name of an X.509v3 security profile to use with RADIUS over TLS authentication — see Security profiles. You can enter the
authentication key in plain text or encrypted format. By default, RADIUS over TLS connections use TCP port 2083, and require
that the authentication key is radsec. You can change the TCP port number on the server.
● Configure a RADIUS over TLS authentication on a RADIUS server in CONFIGURATION mode.
radius-server host {hostname | ip-address} tls security-profile profile-name
[auth-port port-number] key {0 authentication-key | 9 authentication-key |
authentication-key}
To configure more than one RADIUS server for RADIUS over TLS authentication, re-enter the radius-server host tls
command multiple times. If you configure multiple RADIUS servers, OS10 attempts to connect in the order you configured them.
An OS10 switch connects with the configured RADIUS servers one at a time, until a RADIUS server responds with an accept or
reject response. The switch tries to connect with a server for the configured number of retransmit retries and timeout period.
A security profile determines the X.509v3 certificate on the switch to use for TLS authentication with a RADIUS server. To
configure a security profile for an OS10 application, see Security profiles.
Configure global settings for the timeout and retransmit attempts allowed on RADIUS servers as described in RADIUS
authentication.
Configure RADIUS over TLS authentication server
OS10(config)# radius-server host 1.2.4.5 tls security-profile radius-prof key radsec
OS10(config)# radius-server retransmit 10
OS10(config)# radius-server timeout 10
AAA with TACACS+ authentication
Configure a TACACS+ authentication server by entering the server IP address or host name. You must also enter a text string
for the key used to authenticate the OS10 switch on a TACACS+ host. The Transmission Control Protocol (TCP) port entry is
optional.
TACACS+ provides greater data security by encrypting the entire protocol portion in a packet sent from the switch to an
authentication server. RADIUS encrypts only passwords.
● Configure a TACACS+ authentication server in CONFIGURATION mode. By default, a TACACS+ server uses TCP port 49 for
authentication.
tacacs-server host {hostname | ip-address} key {0 authentication-key | 9
authentication-key | authentication-key} [auth-port port-number]
Re-enter the tacacs-server host command multiple times to configure more than one TACACS+ server. If you
configure multiple TACACS+ servers, OS10 attempts to connect in the order you configured them. An OS10 switch connects
with the configured TACACS+ servers one at a time, until a TACACS+ server responds with an accept or reject response.
1320
Security