D-Link DFL-260E User Manual for DFL-260E - Page 68
RADIUS Accounting Security, 2.3.6. RADIUS Accounting and High Availability
View all D-Link DFL-260E manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 68 highlights
2.3.5. RADIUS Accounting Security Chapter 2. Management and Maintenance Some important points should be noted about activation: • RADIUS Accounting will not function where a connection is subject to a FwdFast rule in the IP rule set. • The same RADIUS server does not need to handle both authentication and accounting; one server can be responsible for authentication while another is responsible for accounting tasks. • Multiple RADIUS servers can be configured in NetDefendOS to deal with the event when the primary server is unreachable. 2.3.5. RADIUS Accounting Security Communication between NetDefendOS and any RADIUS accounting server is protected by the use of a shared secret. This secret is never sent over the network but instead a 16 byte long Authenticator code is calculated using a one way MD5 hash function and this is used to authenticate accounting messages. The shared secret is case sensitive, can contain up to 100 characters, and must be typed exactly the same for NetDefendOS and for the RADIUS server. Messages are sent using the UDP protocol and the default port number used is 1813 although this is user configurable. 2.3.6. RADIUS Accounting and High Availability In an HA cluster, accounting information is synchronized between the active and passive NetDefend Firewalls. This means that accounting information is automatically updated on both cluster members whenever a connection is closed. Special Accounting Events Two special accounting events are also used by the active unit to keep the passive unit synchronized: • An AccountingStart event is sent to the inactive member in an HA setup whenever a response has been received from the accounting server. This specifies that accounting information should be stored for a specific authenticated user. • A problem with accounting information synchronization could occur if an active unit has an authenticated user for whom the associated connection times out before it is synchronized on the inactive unit. To get around this problem, a special AccountingUpdate event is sent to the passive unit on a timeout and this contains the most recent accounting information for connections. 2.3.7. Handling Unresponsive RADIUS Servers It can happen that a RADIIUS client sends an AccountingRequest START packet which a RADIUS server never replies to. If this happens, NetDefendOS will re-send the request after the user-specified number of seconds. This will mean, however, that a user will still have authenticated access while NetDefendOS is trying to contact to the accounting server. Three Connection Attempts are Made Only after NetDefendOS has made three attempts to reach the server will it conclude that the accounting server is unreachable. The administrator can use the NetDefendOS advanced setting 68