N OMADIX AG-2000 W ™ / AG-2000 WA ™24 IntroductionRADIUS Proxy (not available with the AG-2000w)The RADIUS Proxy feature relays authentication and accounting packets between theparties performing the authentication process. Different realms can be set up todirectly channel RADIUS messages to the various RADIUS servers. Thisfunctionality can be effectively deployed to: Support a wholesale WISP model directly from the edge without the needfor any centralized AAA proxy infrastructure. Support EAP authenticators (for example, WLAN APs) on the subscriber-side of the NSE to transparently proxy all EAP types (TLS, SIM, etc.) and toallow for the distribution of per-session keys to EAP authenticators andsupplicants.Complementing the RADIUS Proxy functionality is the ability to route RADIUSmessages depending on the Network Access Identifier (NAI). Both prefix-based (forexample, ISP/username@ISP.net) and suffix-based (username@ISP.net) NAI routingmechanisms are supported. Together, the RADIUS Proxy and NAI Routing furthersupport the deployment of the Wholesale Wi-Fi™ model allowing multiple providersto service one location. See also, “RADIUS Client” on page 23.Remember Me and RADIUS Re-AuthenticationThe NSE’s Internal Web Server (IWS) stores encrypted login cookies in the browserto remember logins, using Usernames and Passwords between Access Points. This“Remember Me” functionality creates a more efficient and better user experience inwireless networks.The RADIUS Re-Authentication buffer has been expanded to 720 hours, allowing aneven more seamless and transparent connection experience for repeat users.Secure ManagementThere are many different ways to configure, manage and monitor the performanceand up-time of network devices. SNMP, Telnet, HTTP and ICMP are all commonprotocols to accomplish network management objectives. And within those objectivesis the requirement to provide the highest level of security possible.While several network protocols have evolved that offer some level of security anddata encryption, the preferred method for attaining maximum security across allnetwork devices is to establish an IPSec tunnel using 3DES between the NOC(Network Operations Center) and the edge device (early VPN protocols such as PPTPhave been widely discredited as a secure tunneling method).
