ISR Computing -

How Radius works?

RADIUS Packet General Structure

The attributes section is where an arbitrary number of attribute fields are stored.
"Must have" attributes are the "User-Name" and "User-Password attributes.

The Identifier is a one octet value that allows the RADIUS client to match a RADIUS response with the correct outstanding request.

Simple Authentication Exchange

1) Client sends Access-Request packet
Code = 1 (Accept-Request)
Identifier = simple counter (generated by client)
Length =
Authenticator = randomly chosen 16 bit string.
Attributes:
"User-Name" - clear text
"User-Password" = md5(shared secret + Request Authenticator) XOR "password".

2) Server send Access-Accept
Code=2
Identifier = same as what client sent
Authenticator = MD5 hash of the response packet with the associated request packet's Request Authenticator in the Authenticator field, concatenated with the shared secret.
ResponseAuth = MD5(Code+ID+Length+RequestAuth+Attributes+Secret) where + denotes concatenation.
Attributes: NONE

3) Client received Access-Accept and matches received identifier with the one it sent earlier.

RADIUS Reference

The code establishes the type of RADIUS packet. The codes are:

RADIUS Attribute Types: