Presentation is loading. Please wait.

Presentation is loading. Please wait.

RADIUS Messages RADIUS Message Structure RADIUS Attributes Vendor-Specific Attributes RADIUS Message Exchanges Authentication of Network Access Accounting.

Published byReynaldo Pippins Modified over 9 years ago

Similar presentations

Presentation on theme: "RADIUS Messages RADIUS Message Structure RADIUS Attributes Vendor-Specific Attributes RADIUS Message Exchanges Authentication of Network Access Accounting."— Presentation transcript:

1 RADIUS Messages RADIUS Message Structure RADIUS Attributes Vendor-Specific Attributes RADIUS Message Exchanges Authentication of Network Access Accounting of Network Access RADIUS Proxy Forwarding Summary

2 Access-Request Access-Challenge Access-Accept Access-Reject Accounting-Request Accounting-Response

3

4 RADIUS attributes carry data values that are used in the authentication, authorization, and accounting functions carried out by RADIUS clients, servers, and proxies. These attributes can appear in network access and accounting requests and in response messages. An attribute represents a specific data item, such as a user name or the tunneling protocol in use, sent between the RADIUS client and server. Some attributes can be included more than once, the effect of which is dependent on the specific attribute. When used as RADIUS proxy, NPS preserves the order of the attributes received from the client in messages transmitted to a RADIUS server. There are two types of RADIUS attributes: standard attributes and vendor-specific attributes (VSAs). Standard attributes are defined in RFCs 2865 through 2869 and are used by all RADIUS clients and servers. VSAs are proprietary. Not all RADIUS clients and servers imple-ment all VSAs. For more information, see the section “Vendor-Specific Attributes” later in this chapter.

5

6 Vendor Type Value Attribute NameDescription 1MS-CHAP-Response จะถูกส่งในการตรวจสอบ CHAP Response ซึ่งได้รับจาก Access Client 9MS-RAS-Vendor จะถูกส่งในการตรวจสอบเพื่อระบุ Vendor (Microsoft) 10MS-CHAP-Domain จะสามารถ Access-Accept และ Access-Response Message ระบุ Domain ในที่ผู้ใช้จะได้รับสิทธิ์ 11MS-CHAP-Challenge CHAP-Challenge ที่ใช้ในการตรวจสอบ CHAP, Microsoft CHAP (MS-CHAP) หรือ MS-CHAP v2 16MS-MPPE-Send-Key จะถือ key session เพื่อใช้สำหรับ Microsoft point-to-point encryption (MPPE) คีย์นี้สำหรับเข้ารหัสข้อความที่ส่งมา จาก NAS ถึง Access Client และถูกส่งเฉพาะใน Access- Accept Message ได้รับการเข้ารหัสโดย RADIUS shared secret 17MS-MPPE-Recv-Key จะเป็น key session สำหรับ MPPE จะใช้สำหรับการเข้ารหัส ของแพ็กเก็จ ที่ได้รับ NAS จาก Access-Client และใช้ เฉพาะใน Access-Accept Message 18MS-RAS-Version เป็น Version ของ Routing และ Remote Access ที่เป็นของ RADIUS Message การส่งนี้จะอยู่ใน Access-Request และ Accounting-Request Message 25MS-CHAP2-Response เพื่อตรวจสอบ MS-CHAP v2 ตอบรับจาก Access Client 26MS-CHAP2-Success เพื่อตรวจสอบ MS-CHAP v2 เพื่อบอกว่าการตรวจสอบ สำเร็จ Table 17-3 Common Vendor-Specific Attributes

7 This section describes common RADIUS message exchanges for the following: ■ Authentication of network access ■ Accounting of network access ■ RADIUS proxy forwarding

8 ■ Access-Request followed by Access-Accept ■ Access-Request followed by Access-Reject ■ Access-Request followed by Access- Challenge

9 Frame: + Ethernet: Etype = Internet IP (IPv4) + Ipv4: Next Protocol = UDP, Packet ID = 30882, Total IP Length = 277 - Udp: SrcPort = 3065, DstPort = 1812, Length = 257 SourcePort: 3065, 3065(0xbf9) DestinationPort: 1812, 1812(0x714) TotalLength: 257 (0x101) Checksum: 42833 (0xA751) - Radius: Access Request, Id = 12, Length = 249 MessageType: Access Request, 1(0x01) Identifier: 12 (0xC) AllLength: 249 (0xF9) Authenticator: DB 60 44 6A 2B 19 83 57 FF 75 F1 1D 19 2C 1A 7F + AttributeNasIPAddress: 10.10.1.150 + AttributeServiceType: Framed, 2(0x2) + AttributeFramedProtocol: PPP, 1(0x1)

10 + AttributeNasPort: 128 + AttributeVendorSpecific: + AttributeRadiusNASPortType: Virtual, 5(0x5) + AttributeTunnelType: Point-to-Point Tunneling Protocol (PPTP), 1(0x1) + AttributeTunnelMediumType: IPv4, 1(0x1) + AttributeStationID: 10.10.1.62 + AttributeTunnelClientEndpoint: + AttributeVendorSpecific: + AttributeUserName: KAPOHO\tfl + AttributeVendorSpecific:

11 Frame: + Ethernet: Etype = Internet IP (IPv4) + Ipv4: Next Protocol = UDP, Packet ID = 39615, Total IP Length = 242 + Udp: SrcPort = 1812, DstPort = 3065, Length = 222 - Radius: Access Accept, Id = 12, Length = 214 MessageType: Access Accept, 2(0x02) Identifier: 12 (0xC) AllLength: 214 (0xD6) Authenticator: 5F C7 93 40 22 EA 31 7A A3 4F 82 B1 FA DE 15 77 + AttributeFramedProtocol: PPP, 1(0x1) + AttributeServiceType: Framed, 2(0x2) + AttributeClass: + AttributeVendorSpecific:

12 Frame: + Ethernet: Etype = Internet IP (IPv4) + Ipv4: Next Protocol = UDP, Packet ID = 30899, Total IP Length = 303 + Udp: SrcPort = 3066, DstPort = 1813, Length = 283 - Radius: Accounting Request, Id = 3, Length = 275 MessageType: Accounting Request, 4(0x04) Identifier: 3 (0x3) AllLength: 275 (0x113) Authenticator: EA BB 33 E2 85 8D F8 D5 A6 5C 40 76 54 73 49 09 + AttributeAcctStatusType: Start, 1(0x1) + AttributeAcctDelayTime: 0 + AttributeNasIPAddress: 10.10.1.150 + AttributeServiceType: Framed, 2(0x2) + AttributeFramedProtocol: PPP, 1(0x1) An example of an Accounting-Request/Accounting-Response message exchange is Capture 17-03 (Frame 1)

13 + AttributeNasPort: 128 + AttributeVendorSpecific: + AttributeRadiusNASPortType: Virtual, 5(0x5) + AttributeTunnelType: Point-to-Point Tunneling Protocol (PPTP),1(0x1) + AttributeTunnelMediumType: IPv4, 1(0x1) + AttributeStationID: 10.10.1.62 + AttributeTunnelClientEndpoint: + AttributeVendorSpecific: + AttributeClass: + AttributeVendorSpecific: + AttributeAcctSessionID: 4 + AttributeUserName: KAPOHO\tfl + AttributeFramedIPAddress: 10.10.1.177 + AttributeFramedMTU: 1400 + AttributeAcctMultiSessionID: 27 + AttributeAcctLinkCount: 1 + AttributeEventTimestamp: 1010156648 + AttributeAcctAuthentic: RADIUS, 1(0x1) + AttributeVendorSpecific:

14 Frame: + Ethernet: Etype = Internet IP (IPv4) + Ipv4: Next Protocol = UDP, Packet ID = 40023, Total IP Length = 48 + Udp: SrcPort = 1813, DstPort = 3066, Length = 28 - Radius: Accounting Response, Id = 3, Length = 20 MessageType: Accounting Response, 5(0x05) Identifier: 3 (0x3) AllLength: 20 (0x14) Authenticator: F0 A9 27 34 0D 42 36 4B 7E C7 8A 83 E4 B6 98 41

15 An example of an Access-Request message that is forwarded by a RADIUS proxy is Capture 17-04 (Frame 1) Frame: + Ethernet: Etype = Internet IP (IPv4) - Ipv4: Next Protocol = UDP, Packet ID = 7567, Total IP Length = 278 + Versions: IPv4, Internet Protocol; Header Length = 20 + DifferentiatedServicesField: DSCP: 0, ECN: 0 TotalLength: 278 (0x116) Identification: 7567 (0x1D8F) + FragmentFlags: 0 (0x0) TimeToLive: 128 (0x80) NextProtocol: UDP, 17(0x11) Checksum: 1238 (0x4D6) SourceAddress: 10.10.1.150 DestinationAddress: 10.10.1.201 + Udp: SrcPort = 1711, DstPort = 1812, Length = 258

16 - Radius: Access Request, Id = 8, Length = 250 MessageType: Access Request, 1(0x01) Identifier: 8 (0x8) AllLength: 250 (0xFA) Authenticator: B2 3F 8A 21 54 25 F4 14 4C 30 08 4E 34 5A 82 27 + AttributeNasIPAddress: 10.10.1.150 + AttributeServiceType: Framed, 2(0x2) + AttributeFramedProtocol: PPP, 1(0x1) + AttributeNasPort: 128 + AttributeVendorSpecific: + AttributeRadiusNASPortType: Virtual, 5(0x5) + AttributeTunnelType: Point-to-Point Tunneling Protocol (PPTP), 1(0x1) + AttributeTunnelMediumType: IPv4, 1(0x1) + AttributeStationID: 10.10.1.62 + AttributeTunnelClientEndpoint: + AttributeVendorSpecific: + AttributeUserName: TCP1\rebecca + AttributeVendorSpecific:

17 Frame: + Ethernet: Etype = Internet IP (IPv4) - Ipv4: Next Protocol = UDP, Packet ID = 2894, Total IP Length = 288 + Versions: IPv4, Internet Protocol; Header Length = 20 + DifferentiatedServicesField: DSCP: 0, ECN: 0 TotalLength: 288 (0x120) Identification: 2894 (0xB4E) + FragmentFlags: 0 (0x0) TimeToLive: 128 (0x80) NextProtocol: UDP, 17(0x11) Checksum: 0 (0x0) SourceAddress: 10.10.1.201 DestinationAddress: 10.10.1.151 + Udp: SrcPort = 2203, DstPort = 1812, Length = 268 - Radius: Access Request, Id = 2, Length = 260 MessageType: Access Request, 1(0x01) Identifier: 2 (0x2) AllLength: 260 (0x104)

18 Authenticator: B2 3F 8A 21 54 25 F4 14 4C 30 08 4E 34 5A 82 27 + AttributeNasIPAddress: 10.10.1.150 + AttributeServiceType: Framed, 2(0x2) + AttributeFramedProtocol: PPP, 1(0x1) + AttributeNasPort: 128 + AttributeRadiusNASPortType: Virtual, 5(0x5) + AttributeTunnelType: Point-to-Point Tunneling Protocol (PPTP), 1(0x1) + AttributeTunnelMediumType: IPv4, 1(0x1) + AttributeStationID: 10.10.1.62 + AttributeTunnelClientEndpoint: + AttributeUserName: TCP1\ rebecca + AttributeVendorSpecific: - AttributeProxyState: Type: Proxy State, 33(0x21) Length: 10 (0xA) ProxyState: Binary Large Object (8 Bytes)

19 RADIUS messages have a common structure consisting of a fixed-size portion and a variable-size portion. The fixed-size portion contains fields common to all RADIUS messages. The variable-size portion contains RADIUS attributes, which can be standard attributes or VSAs. RADIUS attributes carry data values that are used in authentication, authorization, and accounting of network access. An authentication exchange is one of the following: Access-Request/Access-Accept for a successful authentication and authorization, Access-Request/Access-Reject for an unsuccessful authentication or authorization, or Access-Request/Access-Challenge when the RADIUS server needs more information to evaluate authentication and authorization. An accounting exchange consists of an Accounting-Request and an Accounting-Response. When RADIUS proxies are between RADIUS clients and RADIUS servers, they modify RADIUS messages by adding or removing a Proxy-State attribute.

20 นางสาว ภาวิณี แก้วสุข รหัส 115130462031-3 กลุ่ม 51346CPE

Download ppt "RADIUS Messages RADIUS Message Structure RADIUS Attributes Vendor-Specific Attributes RADIUS Message Exchanges Authentication of Network Access Accounting."

Similar presentations

Chapter 16. Windows Internet Name Service(WINS) Network Basic Input/Output System (NetBIOS) N etBIOS over TCP/IP (NetBT) provides commands and support.

Chapter 16. Windows Internet Name Service(WINS) Network Basic Input/Output System (NetBIOS) N etBIOS over TCP/IP (NetBT) provides commands and support.
Computer Networks20-1 Chapter 20. Network Layer: Internet Protocol 20.1 Internetworking 20.2 IPv4 20.3 IPv6.

Computer Networks20-1 Chapter 20. Network Layer: Internet Protocol 20.1 Internetworking 20.2 IPv IPv6.
20.1 Chapter 20 Network Layer: Internet Protocol Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.

20.1 Chapter 20 Network Layer: Internet Protocol Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.
PPPoE Last Update 2011.07.21 1.4.0 Copyright 2000-2011 Kenneth M. Chipps Ph.D. www.chipps.com 1.

PPPoE Last Update Copyright Kenneth M. Chipps Ph.D. 1.
McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Ferry Astika Saputra Workshop Administrasi Jaringan TELNET ＆ SSH.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Ferry Astika Saputra Workshop Administrasi Jaringan TELNET ＆ SSH.
Labcourse “Routerlab”

Labcourse “Routerlab”
1 Chapter 2: Networking Protocol Design Designs That Include TCP/IP Essential TCP/IP Design Concepts TCP/IP Data Protection TCP/IP Optimization.

1 Chapter 2: Networking Protocol Design Designs That Include TCP/IP Essential TCP/IP Design Concepts TCP/IP Data Protection TCP/IP Optimization.
Securing Remote PC Access to UNIX/Linux Hosts with VPN or SSH Charles T. Moetului WRQ, Inc. (206) 217-7048

Securing Remote PC Access to UNIX/Linux Hosts with VPN or SSH Charles T. Moetului WRQ, Inc. (206)
McGraw-Hill © ©The McGraw-Hill Companies, Inc., 2004 Chapter 31 Security Protocols in the Internet.

McGraw-Hill © ©The McGraw-Hill Companies, Inc., 2004 Chapter 31 Security Protocols in the Internet.
Virtual Private Networks. Why VPN Fast, secure and reliable communication between remote locations –Use leased lines to maintain a WAN. –Disadvantages.

Virtual Private Networks. Why VPN Fast, secure and reliable communication between remote locations –Use leased lines to maintain a WAN. –Disadvantages.
1 Objectives Configure Network Access Services in Windows Server 2008 RADIUS 1.

1 Objectives Configure Network Access Services in Windows Server 2008 RADIUS 1.
1 Configuring Virtual Private Networks for Remote Clients and Networks.

1 Configuring Virtual Private Networks for Remote Clients and Networks.
70-293: MCSE Guide to Planning a Microsoft Windows Server 2003 Network, Enhanced Chapter 11: Planning Network Access.

70-293: MCSE Guide to Planning a Microsoft Windows Server 2003 Network, Enhanced Chapter 11: Planning Network Access.
K. Salah 1 Chapter 31 Security in the Internet. K. Salah 2 Figure 31.5 Position of TLS Transport Layer Security (TLS) was designed to provide security.

K. Salah 1 Chapter 31 Security in the Internet. K. Salah 2 Figure 31.5 Position of TLS Transport Layer Security (TLS) was designed to provide security.
Hands-On Microsoft Windows Server 2003 Administration Chapter 11 Administering Remote Access Services.

Hands-On Microsoft Windows Server 2003 Administration Chapter 11 Administering Remote Access Services.
VPN – Virtual Private Networking. VPN A Virtual Private Network (VPN) connects the components of one network over another network. VPNs accomplish this.

VPN – Virtual Private Networking. VPN A Virtual Private Network (VPN) connects the components of one network over another network. VPNs accomplish this.
Chapter 18 RADIUS. RADIUS  Remote Authentication Dial-In User Service  Protocol used for communication between NAS and AAA server  Supports authentication,

Chapter 18 RADIUS. RADIUS  Remote Authentication Dial-In User Service  Protocol used for communication between NAS and AAA server  Supports authentication,
Remote Networking Architectures

Remote Networking Architectures
Point-to-Point Protocol (PPP) Security Connecting to remote access servers (RASs) PPP authentication PPP confidentiality Point-to-Point Tunneling Protocol.

Point-to-Point Protocol (PPP) Security Connecting to remote access servers (RASs) PPP authentication PPP confidentiality Point-to-Point Tunneling Protocol.
As first introduced in Chapter 2, “Wide Area Network (WAN) Technologies,” PPP is a stan- dard for using point-to-point network links that provides the.

As first introduced in Chapter 2, “Wide Area Network (WAN) Technologies,” PPP is a stan- dard for using point-to-point network links that provides the.

Similar presentations

Ads by Google