|
|
This appendix provides Token Card and Cisco Secure Authentication support concepts as they apply to the Cisco 700 series router. Cisco Secure Authentication Agent supports single-user mode, which extends B channel authentication to a Cisco Secure Authentication Agent client.
Token cards are considered the most secure authentication solution available. There are two kinds of token cards, synchronous and asynchronous. Currently, Cisco Secure Authentication Agent only supports synchronous token card, which does not need a challenge from a token server to generate a token.
Figure A-1 shows the connection between the client and the token server.
The following steps illustrate how a link is established using a profile:
Step 1 Demand traffic or a call command makes a connection.
Step 2 The router sends a User Datagram Protocol (UDP) packet to a Token Authorization agent (also known as Cisco Secure Authentication Agent), requesting a username and password for PAP and CHAP. If Token Authorization Support (TAS) is set to central, the router always sends the authentication information request to the designated client.
Otherwise, the router sends the request to the source of the interesting packet received if the interesting packet is an IP packet. The router sends the request to the designated client if the interesting packet is not an IP packet.
Step 3 The agent software recognizes the UDP/IP packet and opens an authentication window on the terminal. The user enters the username and token. The agent organizes the information into the PAP and CHAP username and password, based on the router configuration. It then sends the username and password back to the router as a reply packet.
Step 4 The reply packet is received, and the router opens an ISDN connection with Network Access Server (NAS).
Step 5 The router negotiates all line-control protocol options, including which authentication protocol to use (PAP or CHAP).
Step 6 Depending on which authentication protocol is negotiated, the router assembles a PAP request or CHAP response packet and sends it to NAS. If authentication fails, NAS passes the failure message from authentication, authorization, and accounting (AAA) to the router. The router sends one more request to the agent with a message to retry once more. If authentication fails again, the router sends another PAP request with the pppautheninfotype parameter set to message-only to inform the Cisco Secure Authentication Agent client that the authentication failed again and that the router has stopped authorization attempts.
Cisco 700 series routers do not do token caching. A token is cached at the client, and the client sends the router the cached token in response to the authentication request from a link that uses a multilink PPP bundle. With its built-in algorithm, the agent can also generate a new token, called a soft token, instead of prompting the user to enter a new hard token.
There are two authentication modes, PAP and CHAP local secret, shown in the following figures.
Posted: Wed Sep 1 16:38:37 PDT 1999
Copyright 1989-1999©Cisco Systems Inc.