BigIron RX Series Configuration Guide 10153-1001986-01Configuring RADIUS security 4• A list of commands• Whether the user is allowed or denied usage of the commands in the listThe last two attributes are used with RADIUS authorization, if configured.9. The user is authenticated, and the information supplied in the Access-Accept packet for theuser is stored on the BigIron RX. The user is granted the specified privilege level. If youconfigure RADIUS authorization, the user is allowed or denied usage of the commands in thelist.RADIUS authorizationWhen RADIUS authorization takes place, the following events occur.1. A user previously authenticated by a RADIUS server enters a command on the BigIron RX.2. The BigIron RX looks at its configuration to see if the command is at a privilege level thatrequires RADIUS command authorization.3. If the command belongs to a privilege level that requires authorization, the BigIron RX looks atthe list of commands delivered to it in the RADIUS Access-Accept packet when the user wasauthenticated. (Along with the command list, an attribute was sent that specifies whether theuser is permitted or denied usage of the commands in the list.)NOTEAfter RADIUS authentication takes place, the command list resides on the BigIron RX. TheRADIUS server is not consulted again once the user has been authenticated. This means thatany changes made to the user’s command list on the RADIUS server are not reflected until thenext time the user is authenticated by the RADIUS server, and the new command list is sent tothe BigIron RX.4. If the command list indicates that the user is authorized to use the command, the command isexecuted.RADIUS accountingRADIUS accounting works as follows.1. One of the following events occur on the BigIron RX:• A user logs into the management interface using Telnet or SSH• A user enters a command for which accounting has been configured• A system event occurs, such as a reboot or reloading of the configuration file2. The BigIron RX checks its configuration to see if the event is one for which RADIUS accountingis required.3. If the event requires RADIUS accounting, the BigIron RX sends a RADIUS Accounting Startpacket to the RADIUS accounting server, containing information about the event.4. The RADIUS accounting server acknowledges the Accounting Start packet.5. The RADIUS accounting server records information about the event.6. When the event is concluded, the BigIron RX sends an Accounting Stop packet to the RADIUSaccounting server.7. The RADIUS accounting server acknowledges the Accounting Stop packet.
