To understand how radius works what I want to start off with are these three blocks and these three
blocks are going to represent three different devices.
Now way over here on the right we're going to have a radius server. Now a radius server is just a system
that's running some type of radius authentication software.
There's Microsoft IAS there's third party tools like steel belted radius.
There are open source ones like open radius. So some type of authentication software that's running on
a system here.
Now the next thing you're going to have is a radius client. The radius client is not
who's actually being authenticated.
His job is to handle authentication requests from radius supplicants.
So these are the guys who want to get authenticated.
He's just the intermediary that makes the request to the server itself.
So if we take a look at this this is going to be a let's say we have a wireless network for example.
So what I can do here.
Let's have a little fun I'm going to put a little antenna into him.
There you go.
We've got a little wireless antenna to help us appreciate that
this is a wireless access point.
So he'll be set up as a radius client.
And then this radius server will be over here. So the supplicant, this will be just some laptop or somebody
who's trying to get on or a smartphone or something.
He sends his radius request to the radius client who then forwards it to the radius server itself.
Now the important thing about a radius server is that this radius server is going to be using certificates
or usernames and passwords or RSA tokens or something that's coming from the supplicant.
But the actual database itself of user names and passwords or any of that stuff doesn't have to physically
be on this computer. In a lot of situations
this could be like a Windows domain controller or something like this.
And the radius server can actually go ahead and authenticate against domain names in a domain account
or something like that.
So this is a pretty standard setup for a radius.
Now the thing that you need to remember about radius is radius is going to be running on UDP.
It's going to be running on port 1812 or 1813 or 1645 or 1646.
Now here's the big thing you need to keep in mind about all this.
The challenge we're running into is that radius is Triple-A.
So it's authentication authorization and accounting so it authenticates people it authorizes determines
what they can do and it keeps track of who does what.
There is another version of Triple A that is on the Network+ that you should be aware of.
It's called TACACS+.
.
TACACS+ is actually a proprietary Cisco product and it came to be because Cisco had a lot
of customers who had lots of routers and switches and people are going nuts have to log in to all of
these different routers and switches individually and they wanted to come up with a triple-A situation
that would allow people to handle management of a large number of routers and switches.
And that's where Cisco came up with TACACS+.
Now I want to do this again except this time let's put some TACACS+ stuff into the game OK.
So first of all TACACS+ is rarely used in a wireless network I'm not saying it isn't used but it's not
very common so I'm going to start off with a TACACS+ client.
Now what I'm talking about here is a client is this is one of a bazillion different routers that are
in an enterprise it could be anything like that.
Now along with that is going to be a TACACS+ server and this is going to be some computer within the
enterprise itself that's keeping track of all these things.
A TACACS+ user is really just somebody who's logging into the network and wants to get to a bunch of
routers.
So the whole idea of supplicant doesn't really come into play with TACACS+
like it does with radius.
Not to worry.
The one thing you do need to remember and this is going to be on the on the Network+ and that is
that TACACS+ uses TCP port 49.
So make sure you always can appreciate that TACACS+ uses TCP and then radius is going to use UDP.
So the whole reason we really talk about radius and TACACS+ at the same time is because the one
thing they do have in common is they're both triple A.
They both authenticate they both authorize and they both account: keeping track of who's doing what when
and how.