R21xx-HP FlexFabric 11900 Security Configuration Guide

13
AAA for MPLS L3VPNs
In an MPLS L3VPN scenario where clients in different VPNs are centrally authenticated, you can deploy
AAA across VPNs to enable forwarding of RADIUS and HWTACACS packets across MPLS VPNs. For
example, in the network shown in Figure 9, y
ou can deploy the AAA across VPNs feature, so that the PE
at the left side of the MPLS backbone serves as a NAS and transparently delivers the AAA packets of
private users in VPN 1 and VPN 2 to the AAA servers in VPN 3 for centralized authentication.
Authentication packets of private users in different VPNs do not affect each other.
Figure 9 Network diagram
Protocols and standards
The following protocols and standards are related to AAA, RADIUS, HWTACACS, and LDAP:
• RFC 2865, Remote Authentication Dial In User Service (RADIUS)
• RFC 2866, RADIUS Accounting
• RFC 2867, RADIUS Accounting Modifications for Tunnel Protocol Support
• RFC 2868, RADIUS Attributes for Tunnel Protocol Support
• RFC 2869, RADIUS Extensions
• RFC 1492, An Access Control Protocol, Sometimes Called TACACS
• RFC 1777, Lightweight Directory Access Protocol
• RFC 2251, Lightweight Directory Access Protocol (v3)
RADIUS attributes
Commonly used standard RADIUS attributes
No. Attribute Descri
p
tion
1 User-Name Name of the user to be authenticated.
2 User-Password
User password for PAP authentication, only present in Access-Request
packets when PAP authentication is used.
3 CHAP-Password
Digest of the user password for CHAP authentication, only present in
Access-Request packets when CHAP authentication is used.
P
MPLS backbone
PE
PE
CE
CE
CE
VPN 1
VPN 2
VPN 3
RADIUS
server
HWTACACS
server
Host
Host
NAS