Setting Up RADIUS Authentication

This chapter discusses how to configure the RADIUS server to authenticate MAX TNT clients. It consists of the following sections:

Before you begin

Overview of RADIUS authentication

Overview of RADIUS authentication tasks

Setting up name and password authentication

Specifying the MAX TNT unit's name and password

Specifying whether multiple callers can use a profile

Specifying an access protocol for incoming calls

Requesting an access protocol for outgoing calls

Setting up the MAX TNT for callback

Setting up CLID authentication

Setting up called-number authentication

Setting up token-card authentication

Setting up authentication for terminal-server calls

Before you begin

• Check for a RADIUS profile before a local Connection profile.

• Use E1 Chinese signaling and Calling-Line ID (CLID) authentication.

• Return the User Busy (17) Cause Element in ISDN Disconnect packets.

Configuring the MAX TNT to check for a RADIUS profile first

If you set Local-Profiles-First=LFP-RNo and the remote server returns a NAK, the MAX TNT terminates the connection.

Configuring the MAX TNT for E1 Chinese signaling

Specifying User Busy (17) in ISDN Disconnect packets

The default behavior is to send Normal Call Clearing (16). You can specify that the MAX TNT return User Busy (17) by setting the following values in the Rad-Auth-Client subprofile of the External-Auth profile:

• Auth-ID-Fail-Return-Busy=Yes. This setting specifies that the MAX TNT sends User Busy (17) when CLID or called-number authentication fails.

• Auth-ID-Timeout-Return-Busy=Yes. This setting specifies that the MAX TNT sends User Busy (17) when CLID or called-number authentication times out.

Overview of RADIUS authentication

This section assumes that the MAX TNT looks for a local profile first. For an incoming call, the MAX TNT carries out the following authentication steps:

1. Before the MAX TNT answers a call, it determines whether or not the Answer-Defaults profile requires Calling-Line ID (CLID) authentication, called-number authentication, or both.

   The CLID is the phone number of the calling device, which is not always provided by the WAN carrier. When the profile requires CLID authentication, the telco-provided caller ID must match a phone number specified in a local Connection profile or RADIUS user profile.

   The called-party number is the phone number the remote device called to connect to the MAX TNT, but without a trunk group or dialing prefix specification. This number is always available if specified in a profile. When the profile requires called-number authentication, the number called must match a called-party number in a local Connection profile or RADIUS user profile.

2. If the profile requires CLID authentication (CLID-Auth-Mode=CLID-Require in the Answer-Defaults profile) or called-number authentication (CLID-Auth-Mode is set to DNIS-Require in the Answer-Defaults profile), the MAX TNT first looks for a matching phone number in a local Connection profile.

   If one does not exist, it then looks for a matching phone number in a RADIUS user profile. If it cannot find the correct phone number, the MAX TNT hangs up.

3. If the profile does not require CLID or called-number authentication, or if the MAX TNT finds a matching phone number in a local Connection profile or RADIUS user profile, it answers the call.

4. The MAX TNT routes the call.

5. The MAX TNT checks its other Answer-Defaults profile settings.

6. If the Answer-Defaults profile specifies the type of link encapsulation the call uses, the MAX TNT continues checking Answer-Defaults parameters.

   If the Answer-Defaults profile does not enable the type of link encapsulation the call uses, the MAX TNT drops the call.

7. The MAX TNT checks the value of the Profiles-Required parameter in the Answer-Defaults profile.

   If Profiles-Required=Yes, the MAX TNT must find a Connection profile, RADIUS user profile, TACACS profile, or TACACS+ profile to authenticate the call.

8. If a profile is required, the MAX TNT checks to see whether the profile must contain a matching user name and password.

   If Receive-Auth-Mode=PAP-PPP-Auth, CHAP-PPP-Auth, MS-CHAP-PPP-Auth, or Any-PPP-Auth, the MAX TNT requires a matching name and password as a condition of authentication.

9. For IP routing connections, the MAX TNT looks for a Connection profile that matches the client's IP address.

   If it cannot find a Connection Profile, it looks for a RADIUS, TACACS, or TACACS+ profile. The MAX TNT then uses the name and password in the profile to authenticate the session. If the MAX TNT does not find a matching IP address (perhaps because the MAX TNT assigns addresses dynamically), it searches for a profile that matches the name and password that the dial-in client presents.

10. If name and password authentication is required, the MAX TNT attempts to match the caller's name and password to a local Connection profile.

    If authentication succeeds using a local Connection profile, the MAX TNT uses the parameters specified in the profile to build the connection.

11. If it cannot find a matching Connection profile, the MAX TNT looks for a RADIUS, TACACS, or TACACS+ profile containing a matching name and password.

    If authentication succeeds using a RADIUS user profile, the MAX TNT uses the specified RADIUS attributes to build the connection. The MAX TNT can then forward the call to its router or other destination. For example, the MAX TNT might forward a terminal-server call to a Telnet or TCP host.

    If authentication succeeds using a TACACS or TACACS+ profile, the MAX TNT must make a request to the server for information about the resources and services the user can access.

12. If name and password authentication is not required (Receive-Auth-Mode=No-PPP-Auth), the MAX TNT can use the IP address specified by the Connection profile to match IP-routed PPP calls.

13. If the Answer-Defaults profile does not require a profile (Profiles-Required=No), the MAX TNT uses the Answer-Defaults parameters to build the connection.

14. After building the session, the MAX TNT passes the data stream to the appropriate software module or host.

Overview of RADIUS authentication tasks

Other tasks include:

• Specifying the MAX TNT unit's login name and password. (For instructions, see Specifying the MAX TNT unit's name and password.)

• Specifying whether multiple callers can use the same RADIUS user profile. (For instructions, see Specifying whether multiple callers can use a profile.)

• Requesting an access protocol for calls that the MAX TNT dials. (For instructions, see Requesting an access protocol for outgoing calls.)

• Setting up authentication by Calling-Line ID. (For instructions, see Setting up CLID authentication.)

• Setting up authentication by called number. (For instructions, see Setting up called-number authentication.)

• Setting up authentication by means of an external token-card server. (For instructions, see Setting up token-card authentication.)

• Setting up terminal-server authentication. (For instructions, see Setting up authentication for terminal-server calls.)

Setting up name and password authentication

Figure 3-1. Setting up name and password authentication for incoming calls

If you plan to use PAP, CHAP, or MS-CHAP authentication, you must specify a name and password in a RADIUS user profile. Carry out the following tasks:

• Specify the name of the remote user or device with the User-Name (1) attribute.

• Specify the password with the Password (2) attribute.

Specifying a user name

Using the caller's name

Emma Password="pwd", Ascend-PW-Expiration="Jan 30 1997"

Using the Default keyword

For example, the following first line of a profile enables a terminal-server user to log in with his or her UNIX account name or password:

Default Password="UNIX"

Specifying a password

Table 3-1 lists the specifications you can make for the Password attribute.

Table 3-1. Password specifications

Type	Description
Static	A static password represents a string the user must enter to gain access to the MAX TNT. For example: Mark Password="pwd"
UNIX	By setting the Password attribute to "UNIX", you can request validation from the /etc/password file on the UNIX host. Setting the password to "UNIX" provides authentication through the normal UNIX authentication procedure. For example: Mark Password="UNIX" Note: You cannot specify a UNIX password with Challenge Handshake Authentication Protocol (CHAP) authentication.
SAFEWORD	By setting the Password attribute to "SAFEWORD", you can request validation from an Enigma Logic SafeWord server. For example: Mark Password="SAFEWORD" For complete information about setting up token-card authentication, see Setting up token-card authentication.
ACE	By setting the Password attribute to "ACE", you can request validation from a Security Dynamics ACE server. For example: Mark Password="ACE" For complete information about setting up token-card authentication, see Setting up token-card authentication.

Configuring password expiration

• Conditions for replacing expired passwords

• Setting the password expiration attributes

• Changing a nonexpired password

• Changing an expired password

• A RADIUS server authenticates the expired password. The password cannot be a token or a UNIX password.

• The expired password is not a reserved RADIUS password.

  ACE, SAFEWORD, and UNIX are reserved RADIUS passwords. Although a programmer with access to the daemon source code can change these passwords, they are the default reserved passwords, and typically remain so.

• The password belongs to a user in a terminal-server session.

  A user who dials in as an IP router cannot replace an expired password.

• You started the RADIUS daemon with the -p option.

Table 3-2. Password expiration attributes

Attribute	Specifies	Possible values
Ascend-PW-Expiration (21)	Expiration date for the user's password.	A date consisting of a month, day, and year specification. The default is no expiration date.
Ascend-PW-Lifetime (208)	Number of days that a password is valid.	Integer from 0 to 65535. The default is the value of Lifetime-In-Days from the Ascend dictionary.

To set up password expiration, you specify the Ascend-PW-Expiration attribute on the first line of the user profile. Then, you specify the Ascend-PW-Lifetime attribute on any line other than the first one.

Ascend-PW-Expiration

You must specify Ascend-PW-Expiration when you first create a user, and it must appear on the first line of the user profile. If it appears after the first line, RADIUS does not check the expiration date and could accept an expired password. Your specification might look like this one:

Emma Password="pwd", Ascend-PW-Expiration="Jan 1, 1997"

Emma Password="pwd", Ascend-PW-Expiration="Jan 1, 1997"

          Ascend-PW-Lifetime=30,

          ...

How Ascend-PW-Expiration and Ascend-PW-Lifetime work together

For example, suppose that today's date is March 1, 1997 and the following lines appear in a user profile:

Emma Password="pwd", Ascend-PW-Expiration="Jan 1, 1997"

          Ascend-PW-Lifetime=30,

          ...

If the password has not expired, the value of Ascend-PW-Lifetime is irrelevant. For example, suppose that today's date is January 1, 1997 and the following lines appear in a user profile:

Emma Password="pwd", Ascend-PW-Expiration="Jan 15, 1997"

          Ascend-PW-Lifetime=30

          ...

If Ascend-PW-Lifetime is absent, the value of Lifetime-In-Days determines the password duration. The Lifetime-In-Days value in the RADIUS dictionary is the default value for Ascend-PW-Lifetime. By default, Lifetime-In-Days is 0 (zero). This value means that passwords do not expire.

Changing a nonexpired password

1. Enable password expiration in the user profile, following the instructions in Configuring password expiration.

   When you change a nonexpired password, the MAX TNT uses the same mechanism that enables you to enter a new password when an older one has expired.

2. At the terminal-server prompt, enter the Password command:

   ascend% Password
   

   The following prompts appear:

   Enter old password: 
   Enter new password: 
   Re-type new password:
   

3. At the Enter old password prompt, specify the current password.

4. At the Enter new password and Re-type new password prompts, enter the new password. The new password cannot be null, and must differ from the old password.

Password Updated

Password NOT Changed

Changing an expired password

1. The MAX TNT informs the user that the authentication failed because the password has expired.

2. The MAX TNT prompts the user for a new password.

   If the new password is null or matches the old password, the MAX TNT prompts the user again for a new password.

   If the new password is valid, the MAX TNT asks the user to re-enter it for confirmation. If the two entries do not match, the MAX TNT prompts again for a new password.

3. After receiving a valid confirmation of the new password, the MAX TNT contacts the RADIUS server for acceptance of the new password.

   If the RADIUS server accepts the new password, it reports the successful change.

   If the RADIUS server rejects the new password, it informs the user and prompts again for a new password. The RADIUS server can reject the password change for any of the following reasons:

   • You did not start the RADIUS daemon with the -p argument.

   • The file system containing the RADIUS users file is full, and the system cannot update the entry.

   • The RADIUS users file is locked against writing.

   • The RADIUS daemon is running in DBM mode.
     When the daemon is running in DBM mode, a user can successfully change an expired password, but cannot gain access to the network immediately. Access with the new password can take place only after you rebuild the RADIUS database with the modified users file containing the new password.

Along with other attributes on the first line, the values you specify for User-Name and Password determine how the MAX TNT uses the profile. Table 3-3 describes how to set up the first line of a pseudo-user profile for various purposes. Each entry of the table contains a reference for information about completing the rest of the profile.

Some profiles use the following arguments:

• name is the system name of the Ascend unit (the name specified by the Name parameter in the System profile).

• num is a number in a sequential series, starting at 1.

Table 3-3. First-line configuration of pseudo-user profiles

Element configured	First-line specification
Outgoing calls	For the User-Name attribute, specify the name of the remote device that will receive outgoing calls, appending -Out to the user name. Then, set Password="ascend" and User-Service= Dialout-Framed-User. The User-Service setting ensures that no one can use the profile for authentication of an incoming call. For complete information, see Setting up an outgoing PPP, MP, or MP+ connection.
Nailed/MPP connection	permconn-name-num Password="ascend", User-Service= Dialout-Framed-User For complete information, see Setting up a Nailed/MPP connection.
Nailed-up connection	permconn-name-num Password="ascend", User-Service= Dialout-Framed-User For complete information, see Setting up a nailed-up connection.
Message text and list of hosts	For a configuration specific to a single MAX TNT unit: initial-banner-name Password="ascend", User-Service=Dialout-Framed-User For a configuration used by several MAX TNT units: initial-banner Password="ascend", User-Service= Dialout-Framed-User For complete information, see Setting up the message text and a list of hosts.
Frame Relay profile	frdlink-name-num Password="ascend", User-Service= Dialout-Framed-User For complete information, see Setting up the logical link to a Frame Relay switch.
Frame Relay user profile	permconn-name-num Password="ascend", User-Service= Dialout-Framed-User For complete information, see Setting up Frame Relay user connections.
IP address pools	pools-name Password="ascend", User-Service= Dialout-Framed-User For complete information, see Defining a pool of addresses for dynamic assignment.
Static IP routes	For an IP dialout route specific to a single MAX TNT unit: route-name-num Password="ascend", User-Service= Dialout-Framed-User For an IP dialout route used by several MAX TNT units: route-num Password="ascend", User-Service= Dialout-Framed-User For complete information, see Setting up static IP routes.
Static IPX routes	For an IPX dialout route specific to a single MAX TNT unit: ipxroute-name-num Password="ascend", User-Service= Dialout-Framed-User For an IPX dialout route used by several MAX TNT units: ipxroute-num Password="ascend", User-Service= Dialout-Framed-User For complete information, see Setting up static IPX routes.

Examples of setting up name and password authentication

• Authentication of a PPP connection, with or without password expiration

• Authentication using a Default profile for dial-in ISDN and modem users

Figure 3-2. Setting up authentication of a PPP connection

The user's name is Emma and her password is m2dan. To allow a PPP connection that uses IP routing for an incoming call, you would configure Emma's user profile as follows:

Emma Password="m2dan", User-Service=Framed-User

     Framed-Protocol=PPP,

     Framed-Address=200.250.55.9,

     Framed-Netmask=255.255.255.248,

     Ascend-Route-IP=Route-IP-Yes

Emma Password="pwd", Ascend-PW-Expiration="Jan 1, 1997"

          Ascend-PW-Lifetime=30, 

     Framed-Protocol=PPP,

     Framed-Address=200.250.55.9,

     Framed-Netmask=255.255.255.248,

     Ascend-Route-IP=Route-IP-Yes

Example of setting up a Default profile for ISDN and modem clients

Figure 3-3. Setting up a Default user profile

In this example, all users must authenticate by means of Security Dynamics ACE/Server. The ISDN callers use PAP-Token-CHAP authentication. Modem users must enter their PIN and token passcodes. To set up the configuration, you would enter the following settings in the profile:

DEFAULT Password="ACE"

     Ascend-Receive-Secret="test",

     User-Service=Framed-User,

     Framed-Protocol=MPP,

     Ascend-Idle-Limit=120

Specifying the MAX TNT unit's name and password

Table 3-4. MAX TNT unit's login name and password attributes

Attribute	Description	Possible values
Ascend-Authen-Alias (203)	Specifies the MAX TNT unit's login name.	Text string of up to 16 characters. The default is the value of the Name parameter in the System profile.
Ascend-Send-Passwd (232)	Specifies the password that the MAX TNT sends to the remote end of a connection on outgoing calls.	Text string containing up to 20 characters. The default value is null. If you do not specify a password in RADIUS, the MAX TNT uses the value of Send-Password in the local Connection profile.
Ascend-Send-Secret (214)	When used in place of the Ascend-Send-Passwd attribute, directs the system to encrypt the password when sending it between the RADIUS server and the MAX TNT on outgoing calls.	Text string containing up to 20 characters. The default value is null. If you do not specify a password in RADIUS, the MAX TNT uses the value of Send-Password in the local Connection profile.
Password (2)	Specifies the user's password.	Alphanumeric string containing up to 252 characters. The default value is null.
User-Name (1)	Specifies the name of the remote user or device.	Alphanumeric string containing up to 252 characters. The default value is null.
User-Service (6)	Specifies whether the link can use framed or unframed services.	Login-User (1) Framed-User (2) Dialout-Framed-User (5) By default, the MAX TNT does not restrict the services that a link can use.

To configure the MAX TNT unit's name and password for outgoing calls:

1. On the first line of the profile, set the User-Name attribute to the name of the device that will receive outgoing calls, and append -Out to the user name.

2. Set the Password attribute to "ascend".

3. Set User-Service=Dialout-Framed-User.

4. On the second line, set the User-Name attribute to the name of the device that will receive outgoing calls.

5. On any succeeding line, set the Ascend-Authen-Alias attribute to the MAX TNT unit's login name.

6. Set the Ascend-Send-Passwd or Ascend-Send-Secret attribute to the MAX TNT unit's password. (Use Ascend-Send-Passwd only if your version of the MAX TNT does not support Ascend-Send-Secret.)

   If the value you specify for Ascend-Send-Secret or Ascend-Send-Password does not match the value of the remote end's Ascend-Receive-Secret attribute (in a RADIUS user profile) or Recv-Password parameter (in a Connection profile), the remote system rejects the call.

Figure 3-4. Configuring the MAX TNT unit's login name and password

The profile must include values for the Ascend-Authen-Alias and Ascend-Send-Secret attributes. In this example, you might configure the profile as follows:

Homer-Out Password="ascend", User-Service=Dialout-Framed-User

        User-Name="Homer",

        Ascend-Authen-Alias="Alameda",

        Ascend-Send-Auth=Send-Auth-PAP,

        Ascend-Send-Secret="passwrd1",

        Ascend-Dial-Number="31",

        Framed-Protocol=PPP,

        Framed-Address=10.0.100.1,

        Framed-Netmask=255.255.255.0,

        Ascend-Metric=2,

        Framed-Routing=None,

        Framed-Route="10.5.0.0/24 10.0.100.1 1",

        Ascend-Idle-Limit=30

Specifying whether multiple callers can use a profile

You can set up shared profiles on a system-wide or per-profile basis.

• To specify that all RADIUS user profiles can apply to more than a single dial-in user, set Shared-Prof=Yes in the IP-Global profile at the MAX TNT configuration interface.

• To specify that a particular RADIUS user profile can apply to more than a single dial-in user, set Shared-Prof to No in the IP-Global profile and Ascend-Shared-Profile-Enable to Shared-Profile-Yes in the RADIUS user profile.

Figure 3-5. Setting up a shared profile

IP routing and PPP encapsulation are enabled, and each user is assigned an IP address from pool #1. With Shared-Prof=No in the IP-Global profile, you would configure the user profile as follows:

David Password="mypassword", User-Service=Framed-User

      Framed-Protocol=PPP,

      Ascend-Route-IP=Route-IP-Yes,

      Ascend-Assign-IP-Pool=1,

      Ascend-Shared-Profile-Enable=Shared-Profile-Yes

Specifying an access protocol for incoming calls

Table 3-5. Settings for the Receive-Auth-Mode parameter

Setting	Specifies
PAP-PPP-Auth	PAP, a PPP authentication protocol that provides a simple method for the MAX TNT to establish its identity in a two-way handshake. Authentication takes place only upon initial link establishment, and does not use encryption. The remote device must support PAP.
CHAP-PPP-Auth	CHAP, a PPP authentication protocol that is more secure than PAP. CHAP provides a way for the remote device to periodically verify the identity of the MAX TNT by means of a three-way handshake and encryption. Authentication takes place upon initial link establishment. A device can repeat the authentication process at any time after the connection is up. The remote device must support CHAP.
MS-CHAP-PPP-Auth	MS-CHAP, the Windows NT version of CHAP. This protocol uses DES and MD4 encryption. Using MS-CHAP, an Ascend unit can authenticate a Windows NT system, and a Windows NT system can authenticate an Ascend unit.
Any-PPP-Auth	PAP, CHAP, or MS-CHAP. The MAX TNT first tries to use MS-CHAP. If the remote end of the connection does not support it, the MAX TNT then attempts to use CHAP. If the remote end of the connection does not support CHAP, the MAX TNT uses PAP instead.

Consider the following:

• If the incoming PPP call does not include a source IP address, the MAX TNT requires PAP, CHAP, or MS-CHAP authentication.

• For modem or V.120 calls, PAP, CHAP, and MS-CHAP authentication are not available.

• You cannot specify a UNIX password if you are using CHAP authentication.

• For PAP, CHAP, and MS-CHAP authentication, the calling unit and the MAX TNT share a different secret with the RADIUS server.

  • The calling unit's secret is called the remote secret. The MAX TNT does not know the remote secret's value.

  • The MAX TNT unit's secret is called the NAS secret (because the MAX TNT is an NAS). The calling unit does not know the NAS secret's value.

1. The calling unit sends the unencrypted remote secret to the MAX TNT.

2. The MAX TNT uses the NAS secret to encrypt the remote secret.

3. The RADIUS server uses the NAS secret to decrypt the remote secret.

4. The RADIUS server validates the remote secret, or passes the clear copy of the remote secret to a UNIX or other password validation system.

Figure 3-6. How PAP works

How CHAP and MS-CHAP work

1. The MAX TNT sends a random, 128-bit challenge to the calling unit.

2. The calling unit calculates an MD5 digest by means of the remote secret, the challenge, and the PPP packet ID.

3. The calling unit sends the MD5 digest, the challenge, and the PPP packet ID (but not the remote secret) to the MAX TNT.

   The MAX TNT never has the remote secret.

4. The MAX TNT forwards the digest, along with the original challenge and PPP packet ID, to RADIUS.

   No encryption is necessary, because MD5 creates a one-way code that cannot be decoded.

5. The RADIUS server looks up the remote secret in a local database, and calculates an MD5 digest with the local version of the remote secret, along with the challenge and PPP packet ID received from the MAX TNT.

6. The RADIUS server compares the calculated MD5 digest with the digest it received from the MAX TNT.

   If the digests are the same, the remote secrets used by the calling unit and the RADIUS server are the same, and the MAX TNT authenticates the call.

Figure 3-7. How CHAP and MS-CHAP work

Requesting an access protocol for outgoing calls

Table 3-6. Authentication protocol attributes

Attribute	Description	Possible values
Ascend-Send-Auth (231)	Specifies the authentication protocol that the MAX TNT requests when initiating a connection with PPP or MP+ encapsulation. The answering side of the connection determines which authentication protocol, if any, the connection uses.	Send-Auth-None (0) Send-Auth-PAP (1) Send-Auth-CHAP (2) Send-Auth-None is the default.
Ascend-Send-Passwd (232)	Specifies the password the MAX TNT sends to the remote end of a connection on outgoing calls.	Text string of up to 20 characters. The default value is null.
Ascend-Send-Secret (214)	When used in place of the Ascend-Send-Passwd attribute, directs the system to encrypt the password when sending it between the RADIUS server and the MAX TNT on outgoing calls.	Text string of up to 20 characters. The default value is null.
Framed-Protocol (7)	Specifies the type of protocol the link can use.	PPP (1) SLIP (2) ARA (255) MPP (256) FR (261) FR-CIR (263) By default, the MAX TNT does not restrict the type of protocol a link can use.
Password (2)	Specifies the user's password	Alphanumeric string containing up to 252 characters. The default value is null.
User-Name (1)	Specifies the name of the remote user or device.	Alphanumeric string containing up to 252 characters. The default value is null.
User-Service (6)	Specifies whether the link can use framed or unframed services.	Login-User (1) Framed-User (2) Dialout-Framed-User (5) By default, the MAX TNT does not restrict the services that a link can use.

To request an access protocol for outgoing calls:

1. On the first line of the profile, set the User-Name attribute to the name of the device that will receive outgoing calls, and append -Out to the user name.

2. Set the Password attribute to "ascend".

3. Set User-Service=Dialout-Framed-User.

4. On the second line, set the User-Name attribute to the name of the device that will receive outgoing calls.

5. On any succeeding line, set Framed-Protocol=PPP (for a PPP call), or MPP (for an MP+ call).

6. Set the Ascend-Send-Auth attribute to specify an authentication protocol for an outgoing PPP or MP+ call.

   The MAX TNT requests the authentication protocol you specify when it initiates a connection with PPP or MP+ encapsulation. The answering side of the connection determines which authentication protocol, if any, the connection uses.

7. If you request PAP or CHAP authentication, you must specify a password with Ascend-Send-Secret or Ascend-Send-Passwd.

Figure 3-8. Requesting CHAP authentication

For requesting CHAP, the profile must include values for the Ascend-Send-Auth and Ascend-Send-Secret attributes. In this example, you might configure the profile as follows:

TNT-Out Password="ascend", User-Service=Dialout-Framed-User

        User-Name="TNT",

        Ascend-Send-Auth=Send-Auth-CHAP,

        Ascend-Send-Secret="passwrd1",

        Ascend-Dial-Number="31",

        Framed-Protocol=PPP,

        Framed-Address=10.0.100.1,

        Framed-Netmask=255.255.255.0,

        Ascend-Metric=2,

        Framed-Routing=None,

        Framed-Route="10.5.0.0/24 10.0.100.1 1",

        Ascend-Idle-Limit=30

Setting up the MAX TNT for callback

To set up the MAX TNT for callback, use the attributes listed in Table 3-7.

Table 3-7. Callback attributes

Attribute	Description	Possible values
Ascend-Callback (246)	Enables or disables callback.	Callback-No (0) Callback-Yes (1) Callback-No is the default.
Ascend-Dial-Number (227)	Specifies the phone number the MAX TNT dials to reach the router or node at the remote end of the link.	Telephone number of up to 21 characters, limited to the following: 1234567890()[]!z-*#| The MAX TNT sends only the numeric characters to place a call. The default value is null.
Ascend-Send-Passwd (232)	Specifies the password the MAX TNT sends to the remote end of a connection on outgoing calls.	Text string of up to 20 characters. The default value is null.
Ascend-Send-Secret (214)	When used in place of the Ascend-Send-Passwd attribute, directs the system to encrypt the password when sending it between the RADIUS server and the MAX TNT on outgoing calls.	Text string of up to 20 characters. The default value is null.

To configure the MAX TNT for callback:

1. Set Ascend-Callback=Callback-Yes.

2. Set Ascend-Dial-Number to the phone number of the remote device. (The MAX TNT can also use the CLID in order to reach the remote end of the connection, if the CLID is available.)

3. Set Ascend-Send-Secret or Ascend-Send-Passwd. (Use Ascend-Send-Passwd only if your version of the MAX TNT does not support Ascend-Send-Secret.)

1. The MAX TNT hangs up after receiving an incoming call that matches the one specified in the RADIUS user profile.

2. The MAX TNT uses the following values to call back the device at the remote end of the link:

   • Number specified by the Ascend-Dial-Number attribute or the CLID.

   • Password specified by Ascend-Send-Secret or Ascend-Send-Passwd.

Example of configuring the MAX TNT for callback

Figure 3-9. Setting up callback

When the MAX TNT calls back, it requests PAP authentication over an MP+ link. In this example, you would configure Emma's user profile as follows:

Emma Password="pwd"

     User-Service=Framed-User,

     Ascend-Data-Svc=Switched-56K,

     Ascend-Maximum-Time=180,

     Ascend-Dial-Number=555-1213,

     Framed-Route="10.1.2.4 10.1.2.3",

     Ascend-Callback=Callback-Yes,

     Framed-Protocol=MPP,

     Framed-Address=10.1.2.3,

     Ascend-Send-Auth=Send-Auth-PAP,

     Ascend-Send-Passwd="test"

Setting up CLID authentication

This section describes how to set up a RADIUS user profile for CLID authentication. Before you begin your RADIUS configuration, you must set the CLID-Auth-Mode parameter at the MAX TNT configuration interface. If you choose, you can also set other optional parameters.

Then, when you configure RADIUS, you can choose from the following configurations:

• Authenticate all callers using name, password, and caller ID. (For details, see CLID authentication using a name, password, and caller ID.-)

• Authenticate all callers using a caller ID only. (For details, see CLID authentication using a caller ID only.)

• Use an external authentication server, such as a token-card authentication server, to authenticate users after CLID authentication. (For details, see External authentication after CLID authentication.)

• Request PAP, CHAP, or MS-CHAP after CLID authentication. (For details, see PAP, CHAP, or MS-CHAP after CLID authentication.)

Table 3-8. CLID-Auth-Mode settings for CLID authentication

Setting	Description
CLID-Prefer	If you want to authenticate callers by name, password, and caller ID, choose CLID-Prefer. CLID-Prefer specifies that whenever the CLID is available, the MAX TNT checks the calling party's phone number against the value of the Caller-Id attribute in a RADIUS user profile. If it finds a match, and the profile does not require any further authentication, the MAX TNT accepts the call. If the CLID is not available, or if the MAX TNT cannot find a match to the calling-party number, the MAX TNT uses the authentication method specified by the Answer-Defaults profile.
CLID-Require CLID-Fallback	If you want to authenticate callers by caller ID only, choose CLID-Require or CLID-Fallback. CLID-Require specifies that the calling party's phone number must match the value of the Caller-Id attribute before the MAX TNT can answer the call. If CLID is not available, the MAX TNT does not answer the call. CLID-Fallback handles the case of RADIUS server timeouts. If the RADIUS server query times out so that CLID authentication cannot be completed, the MAX TNT does not drop the call. Instead it looks for a resident Connection profile to use for standard PAP, CHAP, MS-CHAP, or terminal-server authentication. Therefore, if you set CLID-Auth-Mode to CLID-Fallback, you must also set up a Connection profile.

General guidelines for CLID authentication

• In some installations, the WAN provider might not be able to deliver CLIDs, or a caller might choose to keep a CLID private.

• CLID authentication applies only if CLID is available end-to-end and Automatic Number Identification (ANI) applies to the call.

• T1 access lines and Switched-56 lines do not support CLID.

• When a user dials into the MAX TNT with MP or MP+, the calling device might have more than one phone number associated with it. In that case, the CLID is the phone number associated with the channel in use.

Table 3-9. Attributes for CLID authentication using name, password, and caller ID

Attribute	Specifies	Possible values
Caller-Id (31)	Calling-party number, indicating the phone number of the user that wants to connect to the MAX TNT.	Telephone number of up to 37 characters, limited to the following: 1234567890()[]!z-*#| The default value is null.
Password (2)	User's password.	Text string of up to 252 characters. The default value is null.
User-Name (1)	Name of the remote user or device.	Text string of up to 252 characters. The default value is null.

To require all callers to use name, password, and caller ID for authentication, first set CLID-Auth-Mode=CLID-Prefer in the Answer-Defaults profile on the MAX TNT. Then, for the first line of all dial-in RADIUS user profiles, use the following format:

username Password="password", Caller-Id="phonenum"

• username is the user name.

• password is the user's password.

• phonenum is the caller ID.

Example of CLID authentication using a name, password, and caller ID

Figure 3-10. Setting up CLID authentication using a name, password, and caller ID

The user profile specifies the name, password, and caller ID on the first line. In this example, you would configure Emma's user profile as follows:

Emma Password="test", Caller-Id="5551213"

          User-Service=Framed-User,

          Framed-Protocol=PPP,

          Framed-Address=255.255.255.254,

          Framed-Netmask=255.255.255.255,

          Ascend-Assign-IP-Pool=1,

          Ascend-Route-IP=Route-IP-Yes,

          Ascend-Idle-Limit=30

Table 3-10. Attributes for CLID authentication using a caller ID only

Attribute	Description	Possible values
Ascend-Require-Auth (201)	Specifies whether the profile requires additional authentication after CLID authentication.	Not-Require-Auth (0) Require-Auth (1) Not-Require-Auth is the default.
Caller-Id (31)	Calling-party number, indicating the phone number of the user that wants to connect to the MAX TNT.	Telephone number of up to 37 characters, limited to the following: 1234567890()[]!z-*#| The default value is null.
Password (2)	Specifies the user's password.	Text string of up to 252 characters. The default value is null.
User-Name (1)	Specifies the name of the remote user or device.	Text string of up to 252 characters. The default value is null.

Although you can configure local Connection profiles for authentication that uses a caller ID only, Ascend recommends that you perform this function in RADIUS. To require all callers to use a caller ID only for authentication, proceed as follows:

1. If you have not done so already, set CLID-Auth-Mode=CLID-Require or CLID-Fallback in the Answer-Defaults profile on the MAX TNT.

2. In all dial-in RADIUS user profiles, set up the first line in the following format:

   phonenum Password="Ascend-CLID" Caller-Id="phonenum"
   

   where the phonenum argument is the calling party's phone number. The Password value specifies that RADIUS authenticates the caller by caller ID only.

3. On a subsequent line of all dial-in profiles, set the Ascend-Require-Auth attribute to Not-Require-Auth.

Figure 3-11. Setting up CLID authentication using a caller ID only

The user profile specifies the calling-party number as both the username and the caller ID. In this example, you would configure the user profile as follows:

5551234 Password="Ascend-CLID", Caller-Id="5551234"

          User-Service=Framed-User,

          Framed-Protocol=PPP,

          Framed-Address=255.255.255.254,

          Framed-Netmask=255.255.255.255,

          Ascend-Assign-IP-Pool=1,

          Ascend-Route-IP=Route-IP-Yes,

          Ascend-Idle-Limit=30

Table 3-11. Attributes for external authentication after CLID authentication

Attribute	Description	Possible values
Ascend-Require-Auth (201)	Specifies whether the profile requires additional authentication after CLID authentication.	Not-Require-Auth (0) Require-Auth (1) Not-Require-Auth is the default.
Caller-Id (31)	Calling-party number, indicating the phone number of the user that wants to connect to the MAX TNT.	Telephone number of up to 37 characters, limited to the following: 1234567890()[]!z-*#| The default value is null.
Password (2)	Specifies the user's password.	Text string of up to 252 characters. The default value is null.
User-Name (1)	Specifies the name of the remote user or device.	Text string of up to 252 characters. The default value is null.

To set up external authentication after CLID authentication, proceed as follows:

1. If you have not done so already, set CLID-Auth-Mode=CLID-Require in the Answer-Defaults profile on the MAX TNT.

2. For the first profile of a two-tiered dial-in setup, specify only these two lines:

   phonenum Password="Ascend-CLID", Caller-Id="phonenum" 
                 Ascend-Require-Auth=Require-Auth
   

   where the phonenum argument is the calling party's phone number.

3. Configure the second-tier user profile with the following format for the first line:

   Default Password="SAFEWORD" or Default Password="ACE"
   

4. On the second and succeeding lines of the second-tier profile, specify the characteristics of the call.

Figure 3-12. Using a token-card server after CLID authentication

In the configuration for this example, you would use two user profiles. You would configure the first profile, as follows, to perform CLID authentication and specify that additional authentication follows:

5551212   Password="Ascend-CLID", Caller-Id="5551212"

                 Ascend-Require-Auth=Require-Auth 

Default   Password="SAFEWORD"

            User-Service=Framed-User,

            Framed-Protocol=PPP, 

            Framed-Address=200.0.5.1,

            Framed-Netmask=255.255.255.0,

            Ascend-Receive-Secret="b5XSAM"

PAP, CHAP, or MS-CHAP after CLID authentication

You specify PAP, CHAP, or MS-CHAP authentication using a two-tiered method with the attributes listed in Table 3-12.

Table 3-12. Attributes for PAP, CHAP, or MS-CHAP after CLID authentication

Attribute	Description	Possible values
Ascend-Require-Auth (201)	Specifies whether the profile requires additional authentication after CLID authentication.	Not-Require-Auth (0) Require-Auth (1) Not-Require-Auth is the default.
Caller-Id (31)	Specifies the calling-party number, indicating the phone number of the user that wants to connect to the MAX TNT.	Telephone number of up to 37 characters, limited to the following: 1234567890()[]!z-*#| The default value is null.
Framed-Protocol (7)	Specifies the type of framed protocol the user can access.	PPP (1) SLIP (2) ARA (255) MPP (256) FR (261) FR-CIR (263) By default, the MAX TNT does not restrict the type of protocol a user can access.
Password (2)	Specifies the user's password.	Text string of up to 252 characters. The default value is null.
User-Name (1)	Specifies the name of the remote user or device.	Text string of up to 252 characters. The default value is null.
User-Service (6)	Specifies the type of services the user can access.	Login-User (1) Framed-User (2) Dialout-Framed-User (5) By default, the MAX TNT does not restrict user access to services.

To request PAP, CHAP, or MS-CHAP authentication after CLID authentication, you must set the Receive-Auth-Mode parameter in the PPP-Answer subprofile of the Answer-Defaults profile. Then, you must configure two RADIUS user profiles, as described in the following sections.

Configuring the first-tier profile

1. Set the User-Name attribute to the calling party's phone number.

2. Set the Password attribute to "Ascend-CLID".

3. Set the Caller-Id attribute to the calling party's phone number.

4. Set the Ascend-Require-Auth attribute to Require-Auth.

   Calls that have been CLID authenticated undergo no further authentication unless the matching RADIUS entry has Ascend-Require-Auth=Require Auth. If Ascend-Require-Auth=Require Auth, the parameters of the call are initially set by CLID authentication, but are subject to change by any authentication that might follow.

1. In the first line, specify the User-Name and Password attributes.

2. On the same line as the User-Name and Password attribute, set the Caller-Id attribute to the phone number you specified for User-Name in the first-tier user profile.

3. On any succeeding lines, set the User-Service=Framed-User and Framed-Protocol=PPP.

4. Specify any additional attributes.

Figure 3-13. Using CHAP after CLID authentication

The following profiles show a two-tiered approach. First, the administrator configures a user profile specifying CLID authentication, and indicating that additional CHAP authentication will follow:

5551212      Password="Ascend-CLID", Caller-Id="5551212"

                    Ascend-Require-Auth=Require-Auth

Virginia    Password="pwd", Caller-Id="5551212"

                    User-Service=Framed-User,

                    Framed-Protocol=PPP,

                    Framed-Address=200.11.12.10,

                    Framed-Netmask=255.255.255.248

                    Ascend-Assign-IP-Pool=1,

                    Ascend-Route-IP=Route-IP-Yes,

                    Ascend-Idle-Limit=30

Setting up called-number authentication

The called-party number is an information element of the Q.931 ISDN signaling protocol. It is the phone number the remote device calls to connect to the MAX TNT, but without a trunk group or dialing prefix specification. This number is always available if specified in a profile. When the profile requires called-number authentication, the number called must match a phone number in a local Connection profile or RADIUS user profile.

This section describes how to set up a RADIUS user profile for called-number authentication. Before you begin your RADIUS configuration, you must set the CLID-Auth-Mode parameter at the MAX TNT configuration interface. Then, when you configure RADIUS, you can choose from the following configurations:

• Authenticate all callers with a name, password, and the called-party number. (For details, see Authentication using a name, password, and called-party number.)

• Authenticate all callers with the called-party number only. (For details, see Authentication using the called-party number only.)

• Use an external authentication server, such as a token-card authentication server, to authenticate users after called-number authentication. (For details, see External authentication after called-number authentication.)

Table 3-13. CLID-Auth-Mode settings for called-number authentication

Setting	Description
DNIS-Prefer	If you want to authenticate callers by name, password, and called-party number, choose DNIS-Prefer. DNIS-Prefer specifies that whenever the called-party number is available, the MAX TNT checks the called-party number against the value of the Client-Port-DNIS attribute in a RADIUS user profile. If it finds a match, and the profile does not require any further authentication, the MAX TNT accepts the call. If the called-party number is not available, or if the MAX TNT cannot find a match to the called-party number, the MAX TNT applies authentication by means of the Receive-Auth-Mode parameter in the PPP-Answer subprofile of the Answer-Defaults profile.
DNIS-Require	If you want to authenticate callers by called-party number only, choose DNIS-Require. This setting indicates that the called-party number must match the value of the Client-Port-DNIS attribute before the MAX TNT can answer the call. If the called-party number is not available, the MAX TNT does not answer the call.

Authentication using a name, password, and called-party number

Table 3-14. Attributes for authentication using a name, password, and called-party number

Attribute	Specifies	Possible values
Client-Port-DNIS	Called-party number, indicating the phone number the user dialed to connect to the MAX TNT.	Telephone number of up to 18 characters, limited to the following: 1234567890()[]!z-*#| The default value is null.
Password (2)	User's password.	Text string of up to 252 characters. The default value is null.
User-Name (1)	Name of the remote user or device.	Text string of up to 252 characters. The default value is null.

To require all callers to use name, password and called-party number for authentication, first set CLID-Auth-Mode=DNIS-Pref in the Answer-Defaults profile on the MAX TNT. Then, for the first line of all dial-in RADIUS user profiles, use the following format:

username Password="password", Client-Port-DNIS="phonenum"

• username is the user name.

• password is the user's password.

• phonenum is the called-party number.

Example using a name, password, and called-party number

Figure 3-14. Setting up authentication using a name, password, and called-party number

Emma is at IP address 255.255.255.254. You would configure her user profile to set up a name, password, and called-party number on the first line:

Emma Password="test", Client-Port-DNIS="5551213"

          User-Service=Framed-User,

          Framed-Protocol=PPP,

          Framed-Address=255.255.255.254,

          Framed-Netmask=255.255.255.255,

          Ascend-Assign-IP-Pool=1,

          Ascend-Route-IP=Route-IP-Yes,

          Ascend-Idle-Limit=30

Table 3-15. Attributes for called-number authentication by called-party number only

Attribute	Description	Possible values
Ascend-Require-Auth (201)	Specifies whether the profile requires additional authentication after called-number authentication.	Not-Require-Auth (0) Require-Auth (1) Not-Require-Auth is the default.
Client-Port-DNIS	Called-party number, indicating the phone number the user dialed to connect to the MAX TNT.	Telephone number of up to 18 characters, limited to the following: 1234567890()[]!z-*#| The default value is null.
Password (2)	Specifies the user's password.	Text string of up to 252 characters. The default value is null.
User-Name (1)	Specifies the name of the remote user or device.	Text string of up to 252 characters. The default value is null.

Although you can configure local Connection profiles for authentication that uses the called-party number only, Ascend recommends that you perform this function in RADIUS. To require all callers to use only the called-party number for authentication, proceed as follows:

1. If you have not done so already, set CLID-Auth-Mode=DNIS-Require in the Answer-Defaults profile on the MAX TNT.

2. In all dial-in RADIUS user profiles, set up the first line in the following format:

   phonenum Password="Ascend-DNIS", Client-Port-DNIS="phonenum"
   

   where the phonenum argument is the called-party number. The Password value specifies that RADIUS authenticates the caller by called-party number only.

3. On a subsequent line of all dial-in profiles, set the Ascend-Require-Auth attribute to Not-Require-Auth.

Figure 3-15. Setting up called-number authentication using the called-party number only

The user at IP address 255.255.255.254 reaches the MAX TNT through a PPP dial-in connection across the WAN. The first line of the user profile specifies the called-party number as both the username and the value of Client-Port-DNIS. In this example, you would configure the user profile as follows:

5551212 Password="Ascend-DNIS", Client-Port-DNIS="5551212"

                Ascend-Require-Auth=Not-Require-Auth,

                User-Service=Framed-User,

                Framed-Protocol=PPP,

                Framed-Address=255.255.255.254,

                Framed-Netmask=255.255.255.255,

                Ascend-Assign-IP-Pool=1,

                Ascend-Route-IP=Route-IP-Yes,

                Ascend-Idle-Limit=30

Table 3-16. Attributes for external authentication after called-number authentication

Attribute	Description	Possible values
Ascend-Require-Auth (201)	Specifies whether the profile requires additional authentication after called-number authentication.	Not-Require-Auth (0) Require-Auth (1) Not-Require-Auth is the default.
Client-Port-DNIS	Called-party number, indicating the phone number the user dialed to connect to the MAX TNT.	Telephone number of up to 18 characters, limited to the following: 1234567890()[]!z-*#| The default value is null.
Password (2)	Specifies the user's password.	Text string of up to 252 characters. The default value is null.
User-Name (1)	Specifies the name of the remote user or device.	Text string of up to 252 characters. The default value is null.

To set up external authentication after called-number authentication, proceed as follows:

1. If you have not done so already, set CLID-Auth-Mode=DNIS-Require in the Answer-Defaults profile on the MAX TNT.

2. For the first profile of a two-tiered dial-in setup, specify only these two lines:

   phonenum Password="Ascend-DNIS", Client-Port-DNIS="phonenum" 
                         Ascend-Require-Auth=Require-Auth
   

   where the phonenum argument is the called-party number.

3. Configure the second-tier user profile with the following format for the first line:

   Default Password="SAFEWORD" or Default Password="ACE" 
   

4. On the second and succeeding lines of the second-tier profile, specify the characteristics of the call.

Figure 3-16. Using a token-card server after called-number authentication

In the configuration for this example, you would use two use profiles. You would configure the first profile, as follows, to set up called-number authentication and to specify that additional authentication follows:

5551212   Password="Ascend-DNIS", Client-Port-DNIS="5551212"

                   Ascend-Require-Auth=Require-Auth 

Default     Password="SAFEWORD"

            User-Service=Framed-User,

            Framed-Protocol=PPP, 

            Framed-Address=200.0.5.1,

            Framed-Netmask=255.255.255.0,

            Ascend-Receive-Secret="b5XSAM"

Setting up token-card authentication

You must choose PAP-Token, Cache-Token, or PAP-Token-CHAP authentication, and make the appropriate settings. (For details, see Configuring PAP-Token authentication, Configuring Cache-Token authentication, and Configuring PAP-Token-CHAP authentication.)

You also have the option of configuring ACE authentication for users behind a remote router. (For instructions, see Configuring ACE authentication for remote router users.)

Introducing token-card authentication

Figure 3-17 illustrates an environment that includes an Ascend Pipeline as the calling unit, an NAS (the MAX TNT), a RADIUS server, and an external authentication server.

Figure 3-17. Using an external authentication server

When you use token-card authentication, the following events take place:

1. A user attempts to open a connection to the MAX TNT, sending his or her user name.

   This user is a client of the MAX TNT. The user can be in terminal-server mode or, alternatively, use the APP Server utility. Ascend Password Protocol (APP) is a UDP protocol from Ascend. When authentication is complete, the user can switch to PPP mode.

2. The MAX TNT determines that it must use a RADIUS user profile to authenticate the user.

3. The MAX TNT sends the user's connection request to the RADIUS server in an Access-Request packet.

   The MAX TNT is a client of the RADIUS server.

4. The RADIUS server forwards the connection request to the ACE or SafeWord client, which resides on the same system as RADIUS.

5. An ACE client forwards the information to the ACE/Server authentication server. A SafeWord client forwards the information to the SafeWord authentication server.

   In either case, the RADIUS server is a client of the authentication server.

6. The authentication server sends an Access-Challenge packet back through the RADIUS server and the MAX TNT to the user dialing in.

7. The user sees the challenge message and obtains the current token from his or her token card.

   If the authentication server is an ACE/Server, the user has a SecurID token card that displays a randomly generated access code. The code changes every 60 seconds.

   If the authentication server is a SafeWord server, the user can have one of the following types of token cards:

   • ActivCard

   • CryptoCard

   • DES Gold

   • DES Silver

   • SafeWord SofToken

   • SafeWord MultiSync

   • DigiPass

   • SecureNet Key

   • WatchWord

8. The user enters the current token obtained from the token card in response to the challenge message.

9. The token travels back through the NAS and the RADIUS server to the authentication server.

10. The authentication server sends a response to the RADIUS server, specifying whether the user has entered the proper user name and password.

    If the user enters an incorrect password, the ACE/Server or SafeWord server returns another challenge, and the user can again attempt to enter the correct password. The server sends up to three challenges. After three incorrect entries, the MAX TNT terminates the call.

11. The RADIUS server sends an authentication response to the MAX TNT.

    If authentication is unsuccessful, the MAX TNT receives an Access-Reject packet. If authentication is successful, the MAX TNT receives an Access-Accept packet. The packet contains a list of attributes from the user profile in the RADIUS server's database. The MAX TNT then establishes network access for the caller.

PAP-Token is appropriate for single-channel, dial-out calls. It is not practical for multichannel calls, because any time that bandwidth requirements cause another channel to come up, the MAX TNT challenges the user for another token. To set up PAP-Token authentication, use the attributes listed in Table 3-17.

Table 3-17. PAP-Token attributes

Attribute	Specifies	Possible values
Password (2)	User's password.	"SAFEWORD" or "ACE". The default value is null.
User-Name (1)	Name of the remote user or device.	Text string of up to 252 characters. The default value is null.

To set up PAP-Token authentication, set the User-Name attribute to the remote router's system name. Then, specify "SAFEWORD" or "ACE" for the Password attribute. By setting the Password attribute to "SAFEWORD", you can request validation from an Enigma Logic SafeWord server. For example:

Mike Password="SAFEWORD"

Connor Password="ACE"

Figure 3-18. Setting up PAP-Token with an ACE/Server

At the remote end, the Appserv process constantly monitors for authentication requests. When it receives one from the Pipeline 50, it sends the request to the MAX TNT. The MAX TNT tries to match the caller's name to the value of the Station parameter in a Connection profile. If the MAX TNT does not find a match, and you have enabled RADIUS, the MAX TNT forwards the request to RADIUS. RADIUS then checks its profiles. If it finds one whose password is set to ACE, it requests that Appserv prompt the Pipeline 50 for a passcode. The authentication server then checks the passcode against the name assigned the Pipeline 50.

To modify an existing profile for ACE/Server authentication, simply change the password to "ACE", as in the following example:

Connor Password="ACE"

       User-Service=Framed-User,

       Framed-Protocol=PPP,

       Framed-Address=200.72.138.1,

       Framed-Netmask=255.255.255.0,

       Ascend-Idle-Limit=300,

       Framed-Routing=None

To set up Cache-Token authentication, use the attributes listed in Table 3-18. Except for the Ascend-Receive-Secret attribute, all attributes must appear on the first line of the user profile.

Table 3-18. Cache-Token attributes

Attribute	Description	Possible values
Ascend-Receive-Secret (215)	Specifies a value the RADIUS server uses to authenticate incoming calls from a user while his or her token is cached and alive. The cached token resides on the MAX TNT during the initial token-card authentication process.	Text string of up to 20 characters. The default value is null.
Ascend-Token-Expiry (204)	Sets the lifetime of a cached token, in minutes (that is, the lifetime of token-card authentication).	Integer from 0 to 65535, representing a number of minutes. The default value is 0 (zero), which specifies that token caching is not allowed. When you accept the default, the MAX TNT rejects subsequent calls.
Ascend-Token-Idle (199)	Specifies the maximum length of time, in minutes, a cached token can remain alive between authentications if a call is idle.	Integer from 0 to 65535, representing a number of minutes. By default, the token remains alive until the value of the attribute Ascend-Token-Expiry is reached.
Ascend-Token-Immediate (200)	Establishes whether or not RADIUS sends the user's password to the token-card server.	Tok-Imm-No (0) Tok-Imm-Yes (1) Tok-Imm-No is the default.
Password (2)	Specifies the user's password.	"SAFEWORD" or "ACE". The default value is null.
User-Name (1)	Specifies the name of the remote user or device.	Text string of up to 252 characters. The default value is null.

To set up Cache-Token authentication:

1. Set the User-Name attribute to the remote router's system name.

2. Specify "SAFEWORD" or "ACE" for the Password attribute.

   If you specify "ACE", the MAX TNT can authenticate multiple users behind the remote router. For details, see Configuring ACE authentication for remote router users. This feature is not available if you specify the "SAFEWORD" setting.

3. Set the Ascend-Token-Expiry attribute to the lifetime in minutes of a cached token.

4. If you want to specify the maximum length of time in minutes a cached token can remain alive between authentication, set the Ascend-Token-Idle attribute (optional).

   This attribute is useful for enforcing authentication when a connection comes up again after an idle period. If you do not specify this attribute, the cached token remains alive until the value of the Ascend-Token-Expiry attribute causes it to expire. Typically, the value of Ascend-Token-Idle is lower than the value of Ascend-Token-Expiry.

5. If the user profile contains the setting User-Service=Login-User, and the token-card server requires that a user enter a challenge, set Ascend-Token-Immediate=Tok-Imm-No.

   When you set Ascend-Token-Immediate=Tok-Imm-No, RADIUS ignores the user's password. If you specify, Tok-Imm-Yes, RADIUS sends the password to the security server for authentication.

6. Set the Ascend-Receive-Secret attribute to the same password as the Send-Password parameter in the Connection profile at the remote end.

   The RADIUS server uses this value to authenticate incoming calls from a user while his or her token is cached and alive. The cached token resides on the MAX TNT during the initial token-card authentication process.

7. When you start the RADIUS daemon, specify the -c argument to enable cache-token authentication.

Figure 3-19. Setting up Cache-Token with a SafeWord server

In this example, you would configure John's user profile as follows:

John    Password="SAFEWORD", Ascend-Token-Expiry=90, 

Ascend-Token-Idle=80, Ascend-Token-Immediate=Tok-Imm-Yes

            Ascend-Receive-Secret="shared-secret",

            User-Service=Framed-User,

            Framed-Protocol=PPP, 

            Framed-Address=200.0.5.1,

            Framed-Netmask=255.255.255.0

Configuring PAP-Token-CHAP authentication

To set up PAP-Token-CHAP authentication, use the attributes listed in Table 3-19.

Table 3-19. PAP-Token-CHAP attributes

Attribute	Specifies	Possible values
Ascend-Receive-Secret (215)	Value the RADIUS server uses to authenticate incoming calls from a user while his or her token is cached and alive. The cached token resides on the MAX TNT during the initial token-card authentication process.	Text string of up to 20 characters. The default value is null.
Password (2)	User's password.	"SAFEWORD" or "ACE". The default value is null.
User-Name (1)	Name of the remote user or device.	Text string of up to 252 characters. The default value is null.

To set up PAP-Token-CHAP authentication:

1. Set the User-Name attribute to the remote router's system name.

2. Specify "SAFEWORD" or "ACE" for the Password attribute.

3. Set Ascend-Receive-Secret to the value of the Aux-Send-Password parameter specified in the remote end's Connection profile.

   The RADIUS server sends this value to your MAX TNT in order to verify an encrypted password.

   Whenever the MAX TNT adds channels to a PPP or MP+ call with PAP-Token-CHAP, the calling unit sends the encrypted value of Aux-Send-Password, and the answering unit checks this password against Ascend-Receive-Secret. The answering unit receives Ascend-Receive-Secret from the RADIUS server when the first channel of the call connects.

Figure 3-20. Setting up PAP-Token-CHAP with a SafeWord server

Because Emma's user profile includes the Ascend-Receive-Secret attribute, the MAX TNT can authenticate additional channels through CHAP without having to go to the SAFEWORD server for authentication each time. In this example, you would configure Emma's user profile as follows:

Emma    Password="SAFEWORD"

            User-Service=Framed-User,

            Framed-Protocol=PPP, 

            Framed-Address=200.0.5.1,

            Framed-Netmask=255.255.255.0,

            Ascend-Receive-Secret="b5XSAM"

Table 3-20. ACE authentication attributes for remote users

Attribute	Specifies	Possible values
Password (2)	User's password.	Text string of up to 252 characters. The default value is null.
User-Name (1)	Name of the remote user or device.	Text string of up to 252 characters. The default value is null.

First, set the User-Name attribute to the remote router's system name. Then, specify "ACE" for the Password attribute. The user must enter the token in this format:

password.realname 

Example of setting up ACE authentication for remote router users

Figure 3-21. Setting up ACE authentication for remote router users

The user profile specifies the system name of the Pipeline 50 and the password for ACE authentication. In this example, you would configure the profile as follows:

Alameda Password="ACE"

        User-Service=Framed-User,

        Framed-Protocol=PPP,

        Framed-Address=200.72.138.1,

        Framed-Netmask=255.255.255.0,

        Ascend-Idle-Limit=300,

        Ascend-Route-IP=Route-IP-Yes

Setting up authentication for terminal-server calls

• Terminal-server calls with PAP, CHAP, or MS-CHAP

• Asynchronous PPP calls using terminal-server authentication

• Digital dial-in using terminal-server authentication

Table 3-21. Terminal-server devices for using PAP, CHAP, or MS-CHAP

Device	Special considerations
Analog modems with no expect-send script	The customer's PPP software must support PAP, CHAP, or MS-CHAP. The software must start negotiating PPP once it registers that the modems have connected.
ISDN TAs using asynchronous-to-synchronous conversion	You must ensure that the customer's TA is configured for asynchronous-to-synchronous conversion. You do not need V.120 support for clients using ISDN TAs with PAP, CHAP, or MS-CHAP authentication.
True ISDN routers, such as the Pipeline 50	None

In Figure 3-22, the dial-in client is connected to an ISDN TA performing asynchronous to synchronous conversion. The connection between the client and the TA is asynchronous, and the ISDN connection between the TA and the MAX TNT is synchronous.

Figure 3-22. A terminal-server connection by means of an ISDN TA with asynchronous PPP

The following events take place:

1. The client calls and the MAX TNT answers.

2. The MAX TNT waits for PPP packets, as specified by the RADIUS user profile or a local Connection profile.

3. The client sends PPP packets.

4. The MAX TNT responds with PPP, and LCP negotiation starts.

5. The MAX TNT carries out PAP, CHAP, or MS-CHAP authentication.

6. After authentication, upper layer NCPs (IPCP, IPXCP, CCP) are negotiated.

7. The client device and the MAX TNT communicate using PPP over the ISDN line.

Configuring asynchronous PPP and terminal-server authentication

Figure 3-23. A terminal-server connection using asynchronous PPP

If a customer is using asynchronous PPP, dialing in over an analog line, and will undergo terminal-server authentication, proceed as follows:

1. If the user will make use of the terminal-server interface and then use PPP, set
   User-Service=Login-User.

2. If the user will bypass the terminal-server interface and use PPP, set
   User-Service=Framed-User.

3. If User-Service=Login-User, set PPP=Yes in the PPP-Mode-Configuration subprofile of the Terminal-Server profile.

4. If User-Service=Login-User, your customer's PPP software must have an expect-send script, at the end of which the user starts sending PPP packets.

1. The client calls with an analog modem, and the MAX TNT answers.

2. The MAX TNT waits for PPP packets, while the client software expects the terminal-server login prompt.

3. The MAX TNT times out on PPP, and sends the login prompt.

4. The client software sees the login prompt, enters a user name, and waits, expecting the password prompt.

5. The MAX TNT sends the password prompt, and the client sends a password.

6. The MAX TNT authenticates the user name and password against a RADIUS profile or local Connection profile.

7. If User-Service=Framed-User in the RADIUS user profile, the MAX TNT does not present the ascend% prompt, but sends PPP packets.

8. If User-Service=Login-User in the RADIUS user profile, the MAX TNT presents the ascend% prompt, and then sends PPP packets.

9. The client software and the MAX TNT communicate using PPP over the asynchronous serial analog line.

Figure 3-24. A terminal-server connection by means of an ISDN TA over a digital line

If a customer is using an ISDN TA, dialing in over a digital line, and will undergo terminal-server authentication, proceed as follows:

1. If the user will make use of the terminal-server interface and then use PPP, set
   User-Service=Login-User.

2. If the user will bypass the terminal-server interface and use PPP, set
   User-Service=Framed-User.

3. If User-Service=Login-User, set PPP=Yes in the PPP-Mode-Configuration subprofile of the Terminal-Server profile.

4. In the Answer-Defaults profile, set V.120=Yes.

5. Make sure that your customer's TA is configured for V.120 encapsulation.You can set most TAs in automatic mode so the TA looks for a PPP packet from the host. If the TA finds a PPP packet, it starts PPP negotiations. If it does not find one, it tries V.120 authentication. Once the call connects, the TA uses async/PPP for the duration of the call.

1. The client calls using an ISDN TA, and the MAX TNT answers the call.

2. The MAX TNT waits for PPP packets, while the client software expects the terminal- server login prompt.

3. The MAX TNT times out on PPP, and sends the login prompt.

4. The client software sees the login prompt, enters a user name, and waits, expecting the password prompt.

5. The MAX TNT sends the password prompt, and the client sends a password.

6. The MAX TNT authenticates the user name and password against a RADIUS profile or local Connection profile.

7. If User-Service=Framed-User in the RADIUS user profile, the MAX TNT does not present the ascend% prompt, but sends PPP packets.

8. If User-Service=Login-User in the RADIUS user profile, the MAX TNT presents the ascend% prompt, and then sends PPP packets.

9. The client software and the MAX TNT communicate using PPP over an asynchronous line- asynchronous from the workstation to the TA, and asynchronous over V.120 from the TA to the MAX TNT.

Most ISDN TAs support either V.120 clear text or asynchronous-to-PPP conversion, but not both. Therefore, if you log into a PPP server in terminal and/or scripted (ASCII text) mode, the TA goes into V.120 mode and should not dial the second B channel. If for some reason the TA does dial the second channel, it will fail to bind the two channels together and will probably drop the first channel.

In order to get the second channel to connect, you must use the authentication area and fill out the Auth.ID: field and the Password: field, and choose the appropriate authentication method, usually PAP or CHAP. If you want a second channel, you cannot use a script or the terminal.

Copyright © 1998, Ascend Communications, Inc. All rights reserved.