19

RADIUS

Making use of a single database of accessible information – as in an Authentication Server – can greatly simplify the authentication and management of users in a large network. One such type of Authentication Server supports the Remote Authentication Dial In User Service (RADIUS) protocol as defined by RFC 2865.

For authenticating users prior to access, the RADIUS standard has become the protocol of choice by administrators of large accessible networks. To accomplish the authentication in a secure manner, the RADIUS client and RADIUS server must both be configured with the same shared password or “secret”. This “secret” is used to generate one-way encrypted authenticators that are present in all RADIUS packets. The “secret” is never transmitted over the network.

RADIUS conforms to a secure communications client/server model using UDP as a transport protocol. It is extremely flexible, supporting a variety of methods to authenticate and statistically track users. RADIUS is also extensible, allowing for new methods of authentication to be added without disrupting existing functionality.

As a user attempts to connect to a functioning RADIUS supported network, a device referred to as the Network Access Server (NAS) or switch/router first detects the contact. The NAS or user-login interface then prompts the user for a name and password. The NAS encrypts the supplied information and a RADIUS client transports the request to a pre-configured RADIUS server. The server can authenticate the user itself, or make use of a back-end device to ascertain authenticity. In either case a response may or may not be forthcoming to the client. If the server accepts the user, it returns a positive result with attributes containing configuration information. If the server rejects the user, it returns a negative result. If the server rejects the client or the shared “secrets” differ, the server returns no result. If the server requires additional verification from the user, it returns a challenge, and the request process begins again.

RADIUS Configuration Example

This example configures two RADIUS servers at 10.10.10.10 and 11.11.11.11. Each server has a unique shared secret key. The shared secrets are configured to be secret1 and secret2 respectively. The server at 10.10.10.10 is configured as the primary server. A new authentication list, called radiusList, is created which uses RADIUS as the primary authentication method, and local authentication as a backup method in the event that the

RADIUS Configuration Example 133

Page 132 Page 134
Page 133
Image 133
D-Link DWS-3000 manual Radius Configuration Example
Page 132 Page 134

DWS-3000 specifications

The D-Link DWS-3000 is an advanced cloud-ready wireless switch designed to meet the increasing demands of modern networks. As organizations transition to more mobile and connected environments, the need for robust and scalable networking solutions becomes paramount. The DWS-3000 addresses this need with its range of features, technologies, and specifications tailored for seamless network management.

One of the standout features of the DWS-3000 is its support for centralized management, allowing IT administrators to oversee multiple access points from a single interface. This simplifies the process of provisioning, monitoring, and troubleshooting network devices, ensuring optimal performance and minimizing downtime. The switch's intuitive web interface and support for D-View, D-Link's network management software, enable effective control over network operations.

The DWS-3000 is equipped with advanced security protocols to safeguard sensitive data within the network. It supports WPA3 encryption, which enhances security compared to its predecessor, WPA2. Additionally, features like MAC address filtering, 802.1X authentication, and rogue AP detection provide comprehensive protection against unauthorized access.

In terms of performance, the DWS-3000 leverages high-capacity hardware to support PoE (Power over Ethernet) technology, enabling power delivery to compatible devices without the need for additional cabling. This feature is particularly beneficial for deployment scenarios where cabling infrastructure is limited.

Moreover, the DWS-3000 is built with scalability in mind. It can support a vast number of access points, making it suitable for deployments ranging from small businesses to large enterprises. This scalability, combined with features like load balancing and Band Steering, ensures efficient use of available bandwidth, enhancing user experience.

The switch also offers seamless integration with D-Link’s suite of access points, allowing for simplified deployments in various environments, whether indoor or outdoor. The capabilities of the DWS-3000 extend into a comprehensive analytics engine, which provides insights into network performance and user behavior, aiding in informed decision-making.

With its blend of advanced features, robust security measures, and scalability, the D-Link DWS-3000 is positioned as a powerful solution for organizations looking to elevate their network infrastructure. It empowers businesses to provide reliable, high-performance wireless connectivity while maintaining security and ease of management in today’s dynamic environment.
Top Page Image Contents