Authentication - RADIUS, TACACS+

SnapGear has extended the SecureEdge VPN Firewall, a platform for OEMs to rapidly produce powerful and secure internet appliances, with the addition of RADIUS and TACACS+.

All of the ColdFire Family and x86 variants of the SecureEdge, using the popular uClinux operating system, now support the RADIUS and TACACS+ protocols. These are the two most widely used protocols, particularly by ISPs, for providing centralized AAA (authentication, authorization, and accounting). Adding this support involved creating two plugins for pppd. Thus anything using pppd can use RADIUS and TACACS+ such as SnapGear's PoPToP PPTP and PPP dialin. Code size increases were minimal:

The SecureEdge VPN Firewalls are available in a mix of models that include multiple 10/100 ethernet ports, serial ports, inboard modems, ADSL, ISDN, and other broadband connectivity. SnapGear has been increasingly asked for wireless support for 802.11b, Bluetooth and other protocols. This incredible range of connectivity options, coupled with a hardened firewall, and industry standard VPN technology make the platform extremely versatile. OEM partners have deployed the units as combinations of access servers, intelligent content filters, conventional routers, corporate edge security solutions, branch office relays, and even as music players! It was a logical extension to add the authentication, authorization and accounting functionality as many customers are ultimately ISPs and their end-users are looking for products that do a little more than just route packets and find the integration options attractive.

AAA - authentication, authorization, and accounting, are the backbone of modern Internet infrastructure for dial-in access servers, billing, and other ISP functions. Authentication determines who is accessing a resource, leading to an Authorization phase to determine what the authenticated user may access and usually provision of an IP address if dialling in, and finally leading to the Accounting function which logs the user actions allowing billing to take place (eg for connect time).

TACACS, an acronym for "Terminal Access Controller Access Control System", has been in use for many years and was extended in 1990 to be XTACACS (both can be found in RFC1492). TACACS+ was a completely new protocol designed to address the shortcomings of the earlier incarnations and was not designed to have backward compatibility. TACACS+ operates over standard TCP protocols and because it separates the authentication and authorization phases there is more flexibility of combinations of AAA methods used.

RADIUS, the other leading protocol, has much functionality in common with TACACS+ although it operates using the more fundamental UDP protocols. The choice between the two methods will depend largely on the incumbent network equipment and environment.

Further information on SnapGear VPN Firewall Appliances

Further information on SecureEdge Development Platforms

Further Technical Bulletins