Setting Up Security-Card Authentication

This chapter contains:

How security cards work

Understanding security-card authentication methods

Setting up incoming security-card calls

Setting up outgoing security-card calls

How the SecurID ACE/Server works without RADIUS

Configuring direct SecurID ACE authentication

Configuring direct Defender server authentication

How security cards work

You can configure a remote authentication server supporting security cards to work with RADIUS or, in the case of the ACE/Server and Defender server, directly, without RADIUS. For information on how security card authentication using the SecurID ACE/Server without RADIUS works, see How the SecurID ACE/Server works without RADIUS and Configuring direct Defender server authentication.

Security card authentication with RADIUS

Figure 5-1. Using an external authentication server

When you use security-card authentication, these events take place:

1. A user attempts to open a connection to the MAX, sending his or her username.

   This user is a client of the MAX. The user can be in terminal server mode or use the APP Server utility during the authentication phase. When authentication is complete, the user can switch to PPP mode.

2. The MAX determines that it must use a RADIUS user profile to authenticate the user.

3. The MAX sends the user connection request to the RADIUS server in an Access-Request packet.

   The MAX is a client of the RADIUS server.

4. The RADIUS server forwards the connection request to the ACE or SafeWord client residing on the same system as RADIUS.

5. The ACE client forwards the information to the ACE/Server authentication server; the SafeWord client forwards the information to the SafeWord authentication server.

   In this case, the RADIUS server is a client of the authentication server.

6. The authentication server sends an Access-Challenge packet back through the RADIUS server and the MAX to the user dialing in.

7. The user sees the challenge message and obtains the current password from his or her security card.

   If the authentication server is an ACE/Server, the user has a SecurID token card that displays a randomly generated access code; this code changes every 60 seconds.

   If the authentication server is a SafeWord server, the user can have one of these types of token cards:

   • ActivCard

   • CryptoCard

   • DES Gold

   • DES Silver

   • SafeWord SofToken

   • SafeWord MultiSync

   • DigiPass

   • SecureNet Key

   • WatchWord

8. The user enters the current password obtained from the security card in response to the challenge message; this password travels back through the NAS and the RADIUS server to the authentication server.

9. The authentication server sends a response to the RADIUS server, specifying whether the user has entered the proper username and password.

   If the user enters an incorrect password, the ACE./Server or SafeWord server returns another challenge and the user can again attempt to enter the correct password. The server sends up to three challenges. After three incorrect entries, the MAX terminates the call.

10. The RADIUS server sends an authentication response to the MAX.

    If authentication is unsuccessful, the MAX receives an Access-Reject packet. If authentication is successful, the MAX receives an Access-Accept packet containing a list of attributes from the user profile in the RADIUS server's database. The MAX then establishes network access for the caller.

This method is useful for installations where other RADIUS features are not required, since it decreases the complexity of the system, making it easier to configure and maintain. In addition, Direct ACE/Server authentication supports the New PIN Mode feature, which allows a dial-in user to change the personal identifying number (PIN). For information on the New PIN Mode feature, see New PIN Mode.

You can also configure ACE/Server authentication to use PAP-TOKEN-CHAP authentication. For more information, see Configuring PAP-TOKEN-CHAP using direct ACE authentication.

Understanding security-card authentication methods

• PAP-TOKEN

  PAP-TOKEN specifies an extension of PAP authentication. The user authenticates his or her identity by entering a password derived from a hardware device, such as a hand-held security card. The MAX prompts the user for this password, possibly along with a challenge key. It obtains the challenge key from a security server that it accesses through RADIUS.

• CACHE-TOKEN

  CACHE-TOKEN uses a shared secret, and simplifies the authentication process by caching the user's token for the fixed length of time specified by the Ascend-Token-Expiry attribute. During the lifetime of the token, subsequent calls by the user require only CHAP authentication without the use of a hand-held security card.

• PAP-TOKEN-CHAP

  PAP-TOKEN-CHAP uses an encrypted CHAP password with which the answering unit authenticates second and subsequent channels of an MP+ call. The advantage of a PAP-TOKEN-CHAP call over a PAP-TOKEN call is that only the initial connection needs to be verified by a hand-held security card. Any additional channels are verified by CHAP only.

Setting up incoming security-card calls

• Configure the MAX to communicate with the RADIUS server.

• Configure a RADIUS user profile for the dial-in user.

You can set up the ACE/Server for use without RADIUS. This method does not permit authentication of PPP dial-in users using the APP Server. To configure the Ace/Server to use PAP-TOKEN-CHAP authentication, see Configuring PAP-TOKEN-CHAP using direct ACE authentication.

If you are not using RADIUS see Configuring direct Defender server authentication.

Setting up outgoing security-card calls

To set up your site for outgoing security-card calls, you must complete these tasks:

1. Configure the MAX to recognize the security-card authentication server.

2. Configure the MAX to recognize the APP Server utility for each security-card user.

   The APP Server utility enables a user to respond to token password challenges received from an external authentication server, such as an ACE/Server or SafeWord server. To allow users to supply token passwords from a host on the local network, you must configure the MAX to communicate with the APP Server utility on that host.

3. Set up dial-out connections in one or more Connection profiles.

4. Install the APP Server utility on each user's computer.

5. Dial a connection to the remote site.

Table 5-1. Authentication server parameters

All of the parameters apply only to outgoing calls using security-card authentication. For the parameters to work, you must meet these conditions:

• The MAX must request PAP-TOKEN authentication. For details, see Requesting PAP-TOKEN authentication.

• You must have the APP Server utility running on a UNIX or Windows workstation on the local network. For details on installing the APP Server utility, see Installing the APP Server utility.

1. Open the Ethernet > Mod Config > DNS menu.

2. For the Password Host parameter, specify the IP address of the authentication server on the remote network.

3. Open the Ethernet > Mod Config > Auth menu.

4. For the Password Port parameter, specify the UDP (User Datagram Protocol) port number that the server indicated by Password Host is monitoring.

   Valid port numbers range from 0 to 65535. The default value is 0 (zero); this setting indicates that the authentication server is not monitoring a UDP port.

5. Set Password Server=Yes.

   This setting specifies that callers use security-card authentication rather than terminal server authentication.

6. Save your changes.

Table 5-2 lists the APP Server parameters.

Table 5-2. APP Server parameters

Location	Parameters with sample values
Ethernet\>Mod Config\>Auth	APP Server=Yes APP Host=10.65.212.1 MAX Port=7001

To setup the MAX to communicate with the APP Server utility, follow these steps:

1. Open the Ethernet > Mod Config > Auth menu.

2. Set APP Server=Yes.

   This setting enables the MAX to communicate password challenges to the host running the APP Server utility.

3. Specify the IP address of the host running the APP Server utility.

   For example, you might enter this setting:

   APP Host=10.65.212.1
   

   If the host obtains its address at boot time from a BOOTP or DHCP server, or if it has no IP address, you can specify the IP broadcast address (255.255.255.255).

4. Specify the UDP port to use for communicating with the host running the APP Server.

   7001 is the default UDP port for the APP Server.If you change this number, you must specify the new UDP port number in the APP Server utility (DOS), the WIN.INI file (Windows), or the /etc/services file (UNIX). The MAX and the host running the APP Server utility must agree about the UDP port number.

5. Save your changes.

• How the MAX transmits the token passwords

• How the user must respond when the system adds channels to an established session

Requesting PAP-TOKEN authentication

The response to the initial password challenge authenticates the base channel of the call. If bandwidth requirements cause another channel to come up, the system challenges the user for a password whenever it adds a channel to a call.

To request PAP-TOKEN authentication for an outgoing call, use the parameters listed in Table 5-3.

Table 5-3. PAP-TOKEN parameters

Location	Parameters with sample values
Ethernet\>Connections > Any Connection profile > Encaps Options	Send Auth=PAP-TOKEN Send PW=*SECURE*

To request PAP-TOKEN authentication in an outgoing Connection profile, follow these steps:

1. Open the Ethernet > Connections menu.

2. Open the Connection profile.

3. Open the Encaps Options submenu.

4. Set Send Auth=PAP-TOKEN.

   The Send Auth parameter specifies the authentication type requested by the caller.

5. For the Send PW parameter, specify a password.

   The MAX sends the value of the Send PW parameter as part of the initial session negotiation. If the session then presents a password challenge, the user types in the current one-time-only password displayed on the security card.

6. Save your changes.

To request CACHE-TOKEN authentication for an outgoing call, use the parameters listed in Table 5-4.

Table 5-4. CACHE-TOKEN parameters

Location	Parameters with sample values
Ethernet\>Connections > Any Connection profile > Encaps Options	Send Auth=CACHE-TOKEN Send PW=*SECURE*

To request CACHE-TOKEN authentication in an outgoing Connection profile, follow these steps:

1. Open the Ethernet > Connections menu.

2. Open the Connection profile.

3. Open the Encaps Options submenu.

4. Set Send Auth=CACHE-TOKEN.

   The Send Auth parameter specifies the authentication type requested by the caller.

5. For the Send PW parameter, specify a password.

   The MAX sends the value of the Send PW parameter as part of the initial session negotiation. The system prompts the user for a token password and uses this password to authenticate the base channel of the call via CHAP. The RADIUS server caches the encrypted password for the period specified by the Ascend-Token-Expiry attribute, or for the amount of idle time specified by the Ascend-Token-Idle attribute. When the system adds channels to a call or places a new call, it uses the cached password to authenticate the channels.

6. Save your changes.

If the calling unit request PAP-TOKEN-CHAP authentication, but the RADIUS user profile at the remote end is not set up for PAP-TOKEN-CHAP, the remote end uses PAP-TOKEN authentication instead.

To request PAP-TOKEN -CHAP authentication for an outgoing call, use the parameters listed in Table 5-5.

Table 5-5. PAP-TOKEN-CHAP parameters

Location	Parameters with sample values
Ethernet\>Connections > Any Connection profile > Encaps Options	Send Auth=PAP-TOKEN-CHAP Send PW=*SECURE* Aux Send PW=*SECURE*

To request PAP-TOKEN-CHAP authentication in an outgoing Connection profile, follow these steps:

1. Open the Ethernet > Connections menu.

2. Open the Connection profile.

3. Open the Encaps Options submenu.

4. Set Send Auth=PAP-TOKEN-CHAP.

   The Send Auth parameter specifies the authentication type requested by the caller.

5. For the Send PW parameter, specify a password.

   The MAX sends the value of the Send PW parameter as part of the initial session negotiation. If the session then presents a password challenge, the user types in the current one-time-only password displayed on the security card.

6. For the Aux Send PW parameter, specify an auxiliary password.

   When the MAX adds additional channels to the call's base channel, CHAP encrypts the auxiliary password specified by Aux Send PW and transmits it to the remote end.

7. Save your changes.

Previous versions of the APP Server utility enabled a single user to respond to password challenges from a remote ACE/Server or SafeWord server. The current version supports multiple tokens-for a user name as well as the current password-so more than one user can use the APP Server to respond to password challenges.

Getting the right version of the utility

The tar file expands into five directories, one for each version of the utility:

• The DOS and Windows executable files are:

  • appsrvds.exe (for DOS)

  • appsrv31.exe (for Windows 3.1)

  • appsrv95.exe (for Windows 95)

  • appsrvnt.exe (for Windows NT)

• The directory contents for the Windows 95 and Windows NT versions are compressed.

• The UNIX utility is supplied as source files.

The banner can contain up to 200 characters and five lines of text. The first line of the file must contain the text "[BANNER]". For example, you might set up the file in this way:

[BANNER]

line1=The security password has changed. Please consult your 

line2=card and enter the current password now.

line3=You have 60 seconds to enter the new password.

1. Create an \ascend directory below the root directory.

2. Copy appsrvds.exe into the \ascend directory.

3. If the appsrvr.ini file exists, copy the file into the \ascend directory.

   For more information on the appsrvr.ini file, see Creating banner text for the password prompt.

4. Open the autoexec.bat file and add a command line to start appsrvds.exe.

   The appsrvds.exe DOS utility does not require an IP stack or IP address, but it does require an ODI driver.

   You must put the command line for appsrvds.exe after the line that loads the network ODI driver and before the line that loads the network protocol stack (TCP/IP, IPX, or another supported protocol). For example:

   C:\novell\lsl.com
   C:\novell\xxxodi.com
   C:\ascend\appsrvds.exe
   

   REM Protocol Stack is loaded next
   

5. Close the autoexec.bat file.

6. Reboot your machine.

• /t - Specifies a time delay between connection attempts (in seconds).

• /y - Specifies the number of cycle counts (attempts to connect) before timeout.

• /m -Specifies the MAC address (in decimal format) of the PC running the utility.

• /p - Specifies a UDP port number for communicating with the MAX.

• /b - Specifies a UDP port for broadcast messages.

• /f - Suppresses the call at startup.

• /d - Disconnects the call.

• /c - Specifies the name of the Connection profile to use to connect to the remote secure network.

• /? -Displays a help screen.

If you do not specify any command-line variables, the APP Server utility uses the following default values:

• Time delay between connection attempts = 20 seconds

• Number of cycles =3 (3 times 20 seconds)

• APP Server PC MAC address = none (zeros)

• UPD port to use = 7001

• Broadcast UDP port =communication UDP port

• APP Server forces a connection upon execution.

For example, consider this command line:

C:\ascend\appsrvds.exe /cChicago /t20 /p7005

Now, consider this command line:

C:\ascend\appsrvds.exe /cChicago /m00805110C7A44 /p7523 /t65 /b7112

Installing the APP Server utility for Windows 3.1

1. Create an \ascend directory below the root directory.

2. Copy appsrv31.exe into the \ascend directory.

3. If the appsrvr.ini file exists, copy that file into the \ascend directory.

   For details on the appsrvr.ini file, see Creating banner text for the password prompt.

4. Copy ctl3d.dll into the Windows \system directory.

To create an icon and add the APP Server to the startup group, follow these steps:

1. Create a new program group in your Program Manager.

   Choose File\>New\>Program Group and type:

   Ascend
   

2. Create an icon for appsrv31.exe in your Program Manager.

   Choose File\>New\>Program Item.

3. To launch the APP Server utility when you start Windows, place the appsrv31.exe icon in your Startup group.

4. Reboot your machine.

1. Copy the file xas-w95.exe into a temporary directory.

   xas-w95.exe is a self-extracting zip file.

2. Execute the file from the DOS shell.

   The zip file expands to several files that comprise the Windows 95 Setup program.

3. From the Start menu, run the Setup program in the temporary directory.

4. Follow the prompts, selecting the directory in which to install APP Server for Windows 95.

Installing the APP Server utility for Windows NT

1. Copy the file xas-nt.exe into a temporary directory.

   xas-nt.exe is a self-extracting zip file.

2. Execute the file from the DOS shell.

   The zip file expands to several files that comprise the Windows NT Setup program.

3. From the Start menu, run the Setup program in the temporary directory.

4. Follow the prompts, selecting the directory in which to install APP Server for Windows NT.

There are three icons provided during installation that enable you to temporarily disable the APP Server, manually control when it runs, or remove it from the system.

• Activate service icon

  Running the activate service icon restarts the utility if it is running, or activates it for the first time.

• Remove service icon

  Running the remove service icon stops the utility if it is running and removes it from the service database. It no longer appears as a service in the Services applet on the Control Panel.

• Uninstall service icon

  Running the uninstall service icon causes the files, icons, program groups, and registry entries to be removed from the system.

1. Edit the Makefile appropriately for your operating system and compiler.

2. Compile the appsrvr source file (make).

3. Add a line to the /etc/services file assigning UDP port 7001 to the APP Server utility.

   To use the default UDP port 7001, add this line to the /etc/services file to document that the port is now in use:

   appServer  7001/udp
   

   If port 7001 is already assigned for a different purpose, you can use a different port for the APP Server utility by adding a line such as this to the services file:

   appServer port_num/udp

   The port_num argument is the port number the utility uses. Make sure you specify the same number using the APP Port parameter on the MAX.

4. If the UNIX host has an IP address, you can run the utility in unicast mode by typing this command at the UNIX prompt:

   ./appsvr
   

   When you run the utility in unicast mode, it transmits packets on the specified UDP port with the source address set to its own IP address. When the MAX receives those packets on the specified UDP port, it returns packets to the specified IP address.

5. If the UNIX host does not have an IP address (for example, if it obtains its address from a BOOTP or DHCP server), run the utility in broadcast mode by typing this command:

   ./appsrvr -b
   

   The -b argument sets a socket option to allow broadcast transmissions and inhibits the utility's complaints about receiving invalid APP frame types when it receives its own transmissions.

Dialing a connection to a secure site

Connecting to a remote network from the terminal server

1. At the terminal server prompt, enter this command:

   set password
   

   The following message displays:

   Entering Password Mode...
   

   The prompt changes to the display following text:

   [^C to exit] Password Mode>
   

2. Bring up a connection to the secure site in one of these ways:

   • Start a program that requires a connection to a host on the remote network.

   • Use the DO menu on the MAX.

   • Dial the remote NAS via modem

   The remote NAS returns a challenge prompt that looks like this one:

   From: hostname
   0-Challenge: challenge 
   

   Enter next password:
   

   hostname is the name of the NAS you are calling; it is optional on some systems.

   If the Send Auth parameter is configured incorrectly, no challenge prompt appears, or you see an error message such as this one:

   From: hostname	
   Received unexpected PAP Challenge!... check PPP Auth Mode
   

3. At the challenge prompt, enter the password obtained from your security card.

   You have 60 seconds to enter the password correctly. When you enter the correct password, the MAX establishes the connection to the secure network. If you do not specify the correct password within 60 seconds, the login attempt times out. If you enter the password incorrectly, the challenge prompt displays again, up to three times.

4. To return to normal terminal server operations, press Ctrl-C at the Password Mode prompt.

From: hostname

0-Challenge: challenge

Enter next password:

If the Send Auth parameter is configured incorrectly, no challenge prompt appears, or you see an error message such as this one:

From: hostname	

Received unexpected PAP Challenge!... check PPP Auth Mode

If more than one user uses the APP Server to log into a remote secure network through the MAX, each user must include a user name in this format:

password.username

1. Start the utility by using the Services applet on the Control Panel.

2. In the dialog that displays, click Connect.

   The Settings dialog box opens.

3. Enter the name of the Connection profile used to log into the remote secure network.

4. Enter your username.

   You can specify up to 32 characters; you cannot enter spaces.

5. Click OK.

   After the initial session negotiation, the remote ACE/Server or SafeWord server returns a password challenge; the challenge displays in its own dialog box. You have 60 seconds to obtain the current dynamic password from the security card and enter it correctly.

6. Type the current password and click OK.

7. To log out of the remote network, click Disconnect.

8. In the dialog that displays, type the name of the Connection profile that defines your connection to the remote network; then, click OK.

From: hostname

0-Challenge: challenge (or null challenge, depending on your 
setup)

Enter next password:

If the Send Auth parameter is configured incorrectly, no challenge prompt appears, or you see an error message such as this one:

From: hostname	

Received unexpected PAP Challenge!... check PPP Auth Mode

If more than one user uses the APP Server to log into a remote secure network through the MAX, each user must include a user name in this format:

password.username

How the SecurID ACE/Server works without RADIUS

** Ascend Pipeline Terminal Server **

Login:

Password:

If the login is correct, the terminal server prompt appears:

ascend%

** Bad Password

NextCode Mode

Wait for the code on your token to change, then enter the new 
code (without PIN).

Passcode:

New PIN Mode

After the normal authentication, the Ascend unit displays one of the following three messages.

1. If the server was configured to allow the user to choose a new PIN or request one from the server, this 5-line message displays:

   Enter your new PIN, containing 4 to 8 digits:
   

                    or 
   

   <Return> to generate a new PIN and display it on the screen:
   

                    or 
   

   <Ctrl C> to cancel the New PIN procedure: 
   

1. If the server was configured to force the user to choose his or her own PIN, this message displays:

   Enter your new PIN, containing 4 to 8 digits:
   

2. If the server was configured to restrict the user from choosing a PIN, and to always generate a random PIN for the user, this message displays:

   Press <Return> to generate a new PIN and display it on the screen:
   

Please re-enter new PIN:

Wait for the code on your token to change, then log in with the 
new PIN

Login:

PINs do not match. Please try again.

Login: 

Server-chosen PIN

ARE YOU PREPARED TO HAVE THE SYSTEM GENERATE A PIN? (y or n) 
[n]:

Your new PIN: 6467

Press Enter to clear screen:

Wait for the code on your token to change, then log in with the 
new PIN

Login:

Configuring direct SecurID ACE authentication

1. For those installations where other RADIUS features are not required, direct SecurID ACE support on the Ascend unit decreases the complexity of the system, making the system easier to configure and maintain.

To configure the MAX for direct authentication using a SecurID ACE server, follow these steps:

1. Open the Ether > net > Mod Config > Auth menu:

   X0-X00 Mod Config
     Auth
     >Auth=SECURID
       Auth Host #1=137.175.80.24
       Auth Host #2=0.0.0.0
       Auth Host #3=0.0.0.0
       Auth Port=2626
       Auth Timeout=10
       Auth Key=N/A
       Auth Pool=No
       APP Server=No
       APP Host=N/A
       APP Port=
       SecurID DES encryption=N/A
       SecurID host retries=N/A
       SecurID NodeSecret=N/A
   

2. Set Auth to SECURID.

   Auth Host #2 and Auth Host #3 are not applicable, because the Ascend unit can support only one SecurID ACE authentication server at this time.

   Note: For a SecurID server to authenticate an AppleTalk Remote Access (ARA) caller through RADIUS, set Auth=RADIUS/LOGOUT. See Setting up ARA authentication for more information about setting up a ARA connection through RADIUS.

3. For the Auth Port parameter, enter the UDP port number used by the SecuridID ACE server.

   For example, you might specify this setting:

   Auth Port=1545
   

4. To specify the number of seconds the MAX waits for a response to an authentication request, set the Auth Timeout parameter.

   If the MAX does not receive a response within the time specified by Auth Timeout, it assumes the SecurID ACE server has become nonfunctional.

5. To specify whether the server uses standard DES or the native encryption provided by SecurID, choose one of the following values for SecurID DES encryption parameter:

   • Yes specifies that the server uses standard DES encryption.

   • No specifies that the server uses the native encryption provided by SecurID.

6. To specify the number of times the Ascend unit attempts to contact the SecurID host before timing out, enter an integer in the SecurID Host Retries parameter.

   The default value is 3.
   

7. Set the SecurID Node Secret parameter.

   For details on this parameter, see the MAX Reference Guide.
   

Shell string structure

<parameters> |<CallType> <parameters> |<CallType> <parameters> ... 

Table 5-6.	 SecurID-ACE shell string structure  





 Parameter

 Possible Values

 Description


 <CallType>


 A


 Following information is only for analog (modem) calls). 


 See the RADIUS NAS-Port attribute for an explanation of which calls are classified as analog and which are classified as digital.



 D


 Following information is only for digital (ISDN) calls.


 See the RADIUS NAS-Port attribute for an explanation of which calls are classified as analog and which are classified as digital.



 " " (space)


 Following information is for all types of calls. 



 



Note:	  Everything from a <CallType> up to 
the next "|" (or the end of the string) is put 
into the caller's profile if and only if the call 
was of the given type.





 <parameters>


 one or more of <parameter>


 



 <parameter>


 rp=<string>


 Applies only to PAP-TOKEN-CHAP calls, since direct SecurID authentication does not support CACHE-TOKEN. This parameter is put in place of the Receive Password in the Connection Profile, and is used for authentication in subsequent calls.


 rp is only used to authenticate the second and subsequent calls in an MP bundle, never the first call. The first call must be authenticated by the user with a token value from the SecurID card.



 


 la=<address>


 The IP address of the caller. This parameter functions the same as LAN Adrs in the Connection Profiles. You can use it to specify an address for the remote caller that is different from the address given in the selected (or default) Connection Profile.



 


 prf=<string>


 The name of the Connection Profile stored in the MAX's NVRAM; provides the configuration of the caller. 


 If there is no profile for a call:


 If Use Answer as Default=Yes (from the Answer profile), the Answer profile is used as the default.


 If Use Answer as Default=No, the Factory Default Profile is used.



 <string>


<stuff>


"<stuff>"


'<stuff>'


[<stuff>]


 <stuff>is the value of the parameter.

Examples of String Contents:

|D prf="isdnroute" rp=[greco] la=192.0.2.1/24 |A prf=modemroute

• if the caller is digital

  • use the profile called isdnroute

  • set the Receive PW to greco

  • set the Lan Addr to 192.0.2.1/24

• if the caller is analog

  • use the profile called modemroute

|D prf=isdnroute rp=greco la=192.0.2.1|A prf=modemroute

• The quotation symbols have been removed. In general, quotes are needed only if there is a space in the character string.

• The space has been removed from before the |A (the | character indicates the end of a string, just like a space).

• The netmask was not given (/24 is the default netmask for 192.0.2.1, a class C network address).

prf=john |D la=135.2.2.4/24 |A la=135.2.3.20

The section with common parameters can be placed after the specific sections as well as before. For example, the following string:

|A prf=modemroute |D prf=isdnroute | la=10.0.0.20/32

Separate sections are not required. For example:

prf=john la=10.0.0.20/32

Or you can have just one or the other:

|D prf=isdnroute rp= "go for it"

String errors

String too long

For security reasons, the password string is not displayed by this debug mode, so you will not be able to tell directly from the debug output whether the rp parameter is being truncated. If you encounter problems with the 2nd and subsequent channels of an MP call automatically authenticating, the problem could be that the end of the rp parameter is being cut off.

Setting overwritten

rp=joebob prf=john

Configuring PAP-TOKEN-CHAP using direct ACE authentication

To set the static password to use during PAP-TOKEN-CHAP for a particular user:

1. Run the sdadmin program on the ACE server machine.

2. From the Client menu, select Edit.

3. Pick the MAX from the list of clients and click OK.

4. Click User Activations.

5. From the Directly Activated Users list, select the one using PAP-TOKEN-CHAP, then click Edit Activation Data.

6. In the Activation Data window, delete any existing text in the Shell field, and replace it with:

   rp="password"

   where password is the password to be configured as the Aux Send PW on the calling router (usually a Pipeline). This is done in step 8.

   For example, if you type

   rp="Little Big"

   in the Shell field (with quotation marks), the password the user types is

   Little Big (without quotation marks).

   In this example, the quotes are delimiters for the password. Different delimiters are allowed is so that the user can choose a password containing those delimiters, for example:

   rp='Quote"quote'

   which contains a double quote in the middle of the password.

   You can use any character you like for the delimiters in place of the double quotes except the vertical bar ("|"), which has a special meaning in the shell field. For example, the following entry would produce the same Receive Password setting as rp="Little Big":

   rp=/Little Big/

   However, rp=[Little Big] is not identical and would an produce error, since the left bracket and right bracket are different characters.

7. Press OK to clear the Activation Data dialog, and Exit to clear the Edit Client dialog

8. Configure the calling router (usually a Pipeline) to use PAP-TOKEN-CHAP authentication, and set Aux Send PW in the Connection profile Encaps options to be identical to the string you entered in the ACE server as rp (Receive Password) in step 6.

Configuring direct Defender server authentication

How Defender server authentication works

Table 5-7. Token card authentication

1	Usually a short time after the caller has connected to the MAX and before the MAX has received the first prompt from the authentication host. The Defender server provides the text of the prompts or challenges, and the MAX passes them through to the caller.	Calls in Stage 1 are preserved if an authentication host is unavailable or loses its connection. This might be the case when the very first caller is authenticating with Defender after the router boots up, and the first authentication host is unavailable. The Defender authentication code in the router will try the second and third hosts in order to authenticate the user.
2	During the time the caller is interacting with the authentication host, but before the authentication sequence is complete. The Defender uses a challenge-response protocol, with a token card to provide the responses.	Calls in Stage 2 are never preserved if an authentication hosts loses its connection. Defender has no mechanism for having one authentication server take over for another if the first loses connection in the middle of a state.
3	When the caller has completed authentication and is interacting with the MAX normally (either asynchronously or framed).	Callers in Stage 3 are not dropped by the router since their calls are already authenticate. However, because the host on which they authenticated is no longer available, their logout time will not be sent (as would be the case if the host had remained connected). Defender provides no mechanism to notify one authentication host when a user call that was authenticated by another host is terminated.

When no authentication host is available

If a caller who has been disconnected tries again to make a connection, the MAX will begin again the process of connecting to authentication hosts on the list until it either succeeds or has tried every host in the list.

To configure a Defender server for direct authentication, follow these steps:

1. Open the Ethernet > Mod Config > Auth menu:

   X0-X00 Mod Config
     Auth
     >Auth=Defender
       Auth Host #1=137.175.80.24
       Auth Host #2=0137.174.81.0
       Auth Host #3=0137.174.80.25
       Auth Port=2626
       Auth Timeout=10
       Auth Key=****************
       Auth Pool=No
       APP Server=No
       APP Host=N/A
       APP Port=N/A
       SecurID DES encryption=N/A
       SecurID host retries=N/A
       SecurID NodeSecret=N/A
   

2. Set Auth to Defender.

3. Specify up to three authentication hosts for the Auth Host # parameters.

4. Set the value of Auth Port to the TCP port number of the Defender authentication server, usually 2626.

5. Set the value of Auth Key.

   Auth Key is used as a DES secret key shared between the Ascend unit and the Defender authentication server. This key is also used for authentication by the Ascend unit in its role as a Defender authentication agent.

6. Set Auth Timeout to indicate the number of seconds the Ascend unit waits before assuming that the Defender server has become nonfunctional.

7. Enter the port number for the source port for remote authentication requests.

   Type a port number between 0 and 65535. The default value is 0 (zero); if you accept this value, the Ascend unit can use any port number between 1024 and 2000.

   You can specify the same port for authentication and accounting requests.

8. Normally APP Server = No. APP Server only applies when the MAX makes outgoing calls to MAXs and other sites using token card authentication. See the MAX Reference Guide for more information.

9. If the MAX must make outgoing calls to other MAX units and to other sites using token- card authentication, you may need to set APP Server=Yes. Normally this parameter is set to APP Server=No. For more details see the MAX Reference Guide.

10. Save your changes.

Copyright © 1998, Ascend Communications, Inc. All rights reserved.