Chapter 5 Security
RADIUS Security
For a configuration that uses a RADIUS client, a RADIUS proxy, and a RADIUS server, the shared secret that is used between the RADIUS client and the RADIUS proxy can be different from the shared secret used between the RADIUS proxy and the RADIUS server.
Shared secrets are used to:
•Verify that RADIUS messages, with the exception of the
•Verify that the RADIUS message has not been modified in transit (message integrity).
•Encrypt some RADIUS attributes, such as
When creating and using a shared secret:
•Use the same
•Use a different shared secret for each RADIUS
•Generate a random sequence at least 22 characters long to ensure a random shared secret.
•Use any standard alphanumeric and special characters.
•Use a shared secret of up to 128 characters in length. To protect your server and your RADIUS clients from brute force attacks, use long shared secrets (more than 22 characters).
•Make the shared secret a random sequence from each of the following three categories: letters (upper or lower case), numbers, and punctuation.
•Change the shared secret often to protect your server and your RADIUS clients from dictionary attacks. An example of a strong shared secret is
Cisco ONS
|
| ||
|
|
