10-8 Firmware User GuideNote: In the latter two modes that involve both RADIUS and the local database, if the local database includesno username/password pairs, authentication will succeed only if the RADIUS server authenticates the user.This differs from the Local Only mode where no authentication is performed when the local database is empty.If the primary RADIUS server responds with an access rejection or an access challenge, the alternate RADIUSserver is not contacted. Only if the primary RADIUS server fails to respond at all is the alternate RADIUS servercontacted.Therefore, do not attempt to select any of the RADIUS options unless you have a RADIUS server correctlyconfigured for this purpose. If you attempt to use RADIUS authentication without a RADIUS server, you will loseyour configuration access to the router.The Advanced Security Options screen supports both a primary RADIUS server and an alternate RADIUSserver. When the router is configured to authenticate using RADIUS, it will first attempt to contact theprimary RADIUS server; if the primary RADIUS server responds, RADIUS authentication succeeds or failsbased on the response returned by the primary server. If and only if the primary server fails to respond, therouter will attempt to contact the alternate RADIUS server to authenticate the user. The router makes twoattempts per server, three seconds apart.• You can specify the Remote Server Addr/Name and the Alt Remote Server Addr/Name either by using ahostname to be resolved using the Domain Name System (DNS) information configured in the router or byusing an IP address in dotted-quad notation. The RADIUS Server Addr/Name items are limited to 63characters.• In addition to specifying the server’s hostname or IP address, you must also specify a Remote ServerSecret and an Alt Remote Server Secret (if configured) known to both the router and the RADIUS server.The secret is used to encrypt RADIUS transactions in transit. The RADIUS Server Secret items are limitedto 31 characters.The router’s RADIUS client implementation supports passwords longer than 16 characters and properlyencrypts such passwords per RFC 2138. Not all RADIUS server implementations handle passwords longerthan 16 characters.• RADIUS Identifier can be either an IP address or an arbitrary string to be used as the identifier in therouter’s outgoing Access-Request packets. The RADIUS identifier is limited to 63 characters.• RADIUS Server Authentication Port specifies the UDP destination port to which the router’s RADIUSauthentication requests will be sent. The default value is 1812, the official IANA-assigned UDP portnumber for the RADIUS authentication service.TACACS+ server authenticationNetopia Firmware Version 8.7 supports TACACS+ server authentication. Its application to a Netopia Router is tocontrol access to the Router’s management interface, and to audit commands submitted by a user.TACACS (Terminal Access Controller Access Control System) protocol provides access control for NetopiaRouters via a centralized server. TACACS+ provides separate authentication, authorization and accountingservices.TACACS allows a client to accept a username and password and query a TACACS authentication server.
