3Com WX3000 operation manual Basic message exchange procedure in Hwtacacs

Compared with RADIUS, HWTACACS provides more reliable transmission and encryption, and therefore is more suitable for security control. Table 1-3 lists the primary differences between HWTACACS and RADIUS.

Table 1-3Differences between HWTACACS and RADIUS

HWTACACS		RADIUS
Adopts TCP, providing more reliable network		Adopts UDP.
transmission.
Encrypts the entire message except the		Encrypts only the password field in
HWTACACS header.		authentication message.
Separates authentication from authorization. For
example, you can use one TACACS server for		Combines authentication and authorization.
authentication and another TACACS server for
authorization.
Is more suitable for security control.		Is more suitable for accounting.
Supports configuration command authorization.	Does not support.

In a typical HWTACACS application (as shown in Figure 1-5), a terminal user needs to log into the device to perform some operations. As a HWTACACS client, the device sends the username and password to the TACACS server for authentication. After passing authentication and being authorized, the user successfully logs into the switching engine to perform operations.

Figure 1-5Network diagram for a typical HWTACACS application

HWTACACS server

Host HWTACACS client

HWTACACS server

Basic message exchange procedure in HWTACACS

The following text takes telnet user as an example to describe how HWTACACS implements authentication, authorization, and accounting for a user. Figure 1-6 illustrates the basic message exchange procedure:

1-7