Working with Remote Authentication Dial-up Service (RADIUS) Authentication

The Remote Authentication Dial-up Service (RADIUS) is a networking protocol for managing authentication, authorization, and accounting in a network. It defines a workflow for communication of information between the resources and services in a network. The RADIUS protocol uses the UDP transport layer for communication. The RADIUS protocol consists of two components, the RADIUS server and the RADIUS client. The server receives the authentication and authorization requests of users from the RADIUS clients. The communication between the RADIUS client and RADIUS server is authenticated using a shared secret key.

You can integrate the RADIUS protocol with an ESA for two-factor authentication. The following figure describes the implementation between ESA and the RADIUS server.

• The ESA is connected to the AD that contains user information.
• The ESA is a client to the RADIUS sever that contains the network and connection policies for the AD users. It also contains a RADIUS secret key to connect to the RADIUS server. The communication between the ESA and the RADIUS sever is through the Password Authentication Protocol (PAP).
• An OTP generator is configured with the RADIUS server. An OTP is generated for each user. Based on the secret key for each user, an OTP for the user is generated.

In ESA, the following two files are created as part of the RADIUS configuration:

• The dictionary file that contains the default list of attributes for the RADIUS server.
• The custom_attributes.json file that contains the customized list of attributes that you can provide to the RADIUS server.

Important : When assigning a role to the user, ensure that the Can Create JWT Token permission is assigned to the role.
If the Can Create JWT Token permission is unassigned to the role of the required user, then remote authentication fails.
To verify the Can Create JWT Token permission, from the ESA Web UI navigate to Settings > Users > Roles.

Configuring Radius Two-Factor Authentication

To configure Radius two-factor authentication:

1. On the Appliance Web UI, navigate to Settings > Security > Two Factor Authentication.

2. Check the Enable Two-Factor-Authentication checkbox.

3. Select the Radius Server option as shown in the following figure.

   

4. Type the IP address or the hostname of the RADIUS server in the Radius Server text box.

5. Type the secret key in the Radius Secret text box.

6. Type the port of the RADIUS server in the Radius port text box.
   Alternatively, the default port is 1812.

7. Type the username that connects to the RADIUS server in the Validation User Name text box.

8. Type the OTP code for the user in the Validation OTP text box.

9. Click Validate to validate the configuration.
   A message confirming the configuration appears.

10. Click Apply to apply the changes.

Logging in to the Web UI

Perform the following steps to login to the Web UI:

1. Open the ESA login page.

2. Type the user credentials in the Username and Password text boxes.

3. Click Sign-in.
   The following screen appears.

   

4. Type the OTP code and select Verify.
   After the OTP is validated, the ESA home page appears.

Editing the Radius Configuration Files

To edit the configuration files:

1. On the Appliance Web UI, navigate to Settings > System.

2. Under OS-Radius Server tab, click Edit corresponding to the custom_attibutes.json or directory to edit the attributes.

3. If required, modify the attributes to the required values.

4. Click Save.
   The changes are saved.

Logging in to the CLI

Perform the following steps to login to CLI Manager:

1. Open the Appliance CLI Manager.

2. Enter the user credentials.

3. Press ENTER .
   The following screen appears.

   

4. Type the verification code and select OK.
   After the code is validated, the main screen for the CLI Manager appears.

• ←Previous
• Next→