Configuring the RADIUS Login Authentication Mode

The local login authentication mode is enabled by default. You can change the local login authentication mode to RADIUS-based authentication.

Note

Before you change the default local login authentication to RADIUS-based authentication, you must configure the RADIUS Server on the Global Settings screen. For more information, see VNS Global Settings.

RADIUS is a client/server authentication and authorization access protocol used by a network access server (NAS) to authenticate users attempting to connect to a network device. The NAS functions as a client, passing user information to one or more RADIUS servers. The NAS permits or denies network access to a user based on the response it receives from one or more RADIUS servers. RADIUS uses User Datagram Protocol (UDP) for sending the packets between the RADIUS client and server.

You can configure a RADIUS key on the client and server. If you configure a key on the client, it must be the same as the one configured on the RADIUS servers. The RADIUS clients and servers use the key to encrypt all RADIUS packets transmitted. If you do not configure a RADIUS key, packets are not encrypted. The key itself is never transmitted over the network.

Note

Before you configure the system to use RADIUS-based login authentication, you must configure the Service-Type RADIUS attribute on the RADIUS server.

EWC uses the standard RADIUS attribute Service-Type to put the user into the appropriate groups:

• Administrator Service-Type = 6
• Read-Only Service-Type = 7
• GuestPortal Manager Service-Type = 8

To configure the RADIUS login authentication mode:

1. From the top menu, click Controller.
2. In the left pane, click Administration > Login Management. The Login Management screen displays.
3. Click the RADIUS Authentication tab.
   

   
4. In the Authentication mode section, click Configure.

   The Login Authentication Mode Configuration window is displayed.

   

   
5. Select the RADIUS checkbox.

   If the Local checkbox is selected, deselect it.

6. Click OK.
7. From the drop-down list, located next to the Use button, select the RADIUS Server that you want to use for the RADIUS login authentication, and then click Use. The RADIUS Server‘s name is displayed in the Configured Servers box, and in the Auth section, and the following default values of the RADIUS Server are displayed.
   

   Note

   The RADIUS Servers displayed in the list located against the Use button are defined on Global Settings screen. For more information, see VNS Global Settings.

   The following values can be edited:

   • NAS IP address — The IP address of Network Access Server (NAS).
   • NAS Identifier — The Network Access Server (NAS) identifier. The NAS identifier is a RADIUS attribute that identifies the server responsible for passing information to designated RADIUS servers, and then acting on the response returned.
   • Auth Type — The authentication protocol type (PAP, CHAP, MS-CHAP, or MS-CHAP2).
   • Set as Primary Server — Specifies the primary RADIUS server when there are multiple RADIUS servers.
8. To add additional RADIUS servers, repeat Step 7.
   

   Note

   You can add up to three RADIUS servers to the list of login authentication servers. When you add two or more RADIUS servers to the list, you must designate one of them as the Primary server. The controller first attempts to connect to the Primary server. If the Primary Server is not available, it tries to connect to the second and third server according to their order in the Configured Servers box. You can change the order of RADIUS servers in the Configured Servers box by clicking on the Up and Down buttons.
9. Click Test to test connectivity to the RADIUS server.
   

   Note

   You can also test the connectivity to the RADIUS server after you save the configuration. If you do not test the RADIUS server connectivity, and you have made an error in configuring the RADIUS-based login authentication mode, you will be locked out of the controller when you switch the login mode to the RADIUS login authentication mode. If you are locked out, access Rescue mode via the console port to reset the authentication method to local.

   The following window is displayed.

   

   
10. In the User ID and the Password boxes, type the user‘s ID and the password, which were configured on the RADIUS Server, and then click Test. The RADIUS connectivity result is displayed.

Note
To learn how to configure the User ID and the Password on the RADIUS server, refer to your RADIUS server‘s user guide.


If the test is not successful, the following message will be displayed:

11. If the RADIUS connectivity test displays “Successful” result, click Save on the RADIUS Authentication screen to save your configuration.

    The following window is displayed:

    

    
12. If you tested the RADIUS server connectivity earlier in this procedure, click No. If you click Yes, you will be asked to enter the RADIUS server user ID and password.
13. To change the authentication mode to RADIUS authentication, click OK.

    You will be logged out of the controller immediately. You must use the RADIUS login user name and password to log on the controller.

    To cancel the authentication mode changes, click Cancel.