- [Instructor] One of the most common access control
needs is for an organization to have a
centralized approach to network and application
authentication, authorization, and accounting.
The RADIUS and TACACS protocols offer
this service to enterprises.
RADIUS is an acronym which stands for
Remote Access Dial-In User Service.
As the name implies, RADIUS was first used
to authenticate the users of modem based dial-in services
back in the 1980s and 1990s.
A centralized RADIUS server could support modem pools
located around the country providing a single point
of administration for password and account management,
and consolidating accounting records
in a centralized location.
RADIUS is still used today, even though dial-in
modem pools are a thing of the past.
Today they're used to allow many diverse applications
to rely upon the same authentication source.
Here's how it might work in a wireless network, for example.
First, the end user attempts to connect
to a wireless access point.
The access point serves as the client in the RADIUS request.
Passing a request for authentication to a RADIUS server.
The RADIUS server then checks with an external
authentication choice such as an active directory
or LDAP server to determine whether the
users password is correct.
If the password is correct, the RADIUS server sends
an access accepted message back to
the wireless access point,
which allows the user on the network.
If the password is incorrect, the RADIUS server sends
an access rejected message back to the
wireless access point, which denies
the user access to the network.
In this example, we talked about passwords, but
RADIUS can also support other authentication factors.
As you prepare for exam, be sure that you understand the
concept of a RADIUS client and server.
When you look at it from an application perspective,
the RADIUS client may actually be an application server.
In our example of a wireless network, the end user
is the wireless client, but the wireless network, itself,
is the one performing the RADIUS authentication, so the
the access point is the RADIUS client.
RADIUS does have a couple of down sides.
First it uses the connectionless User Datagram Protocol, or
UDP which reduces its reliability.
Second, while it does provide cryptographic protection
for the password, most of the data sent in a RADIUS
connection is unencrypted requiring the use of
additional security measures.
TACACS, the Terminal Access Controller
Access Control System, is an alternative
to RADIUS performing a similar function.
First developed in the 1980s, there were two early versions
of TACACS rarely used today.
The original TACACS protocol also used UDP and is rarely
found in production settings today.
Cisco later released their own
proprietary version of TACACS.
The extended TACACS or XTACACS protocol.
It is also rarely used today.
The current TACACS standard is the TACACS+ protocol
developed by Cisco as a proprietary standard.
It functions in a manner similar to RADIUS with
two improvements.
First, it uses the connection-oriented and reliable
transmission control protocol, TCP, instead of the
less reliable UDP.
Second, it fully encrypts the entire authentication session.
You'll find RADIUS and TACACS plus in use in many
different enterprises around the world.