Typical RADIUS setup

OneSpan Authentication Server Appliance can be used in a RADIUS environment in a number of ways. In the following topics, the configuration of a typical RADIUS setup is explained.

Figure:  Standalone OneSpan Authentication Server Appliance in a RADIUS environment

In a typical standalone environment (see Figure: Standalone OneSpan Authentication Server Appliance in a RADIUS environment), a RADIUS client is configured for authenticator authentication only towards OneSpan Authentication Server Appliance. A RADIUS client can be one of the following:

• Dial-up network access server (NAS)
• Firewall or VPN appliance
• Wireless access point
• Any other device that uses the RADIUS protocol for user authentication.

The OneSpan Authentication Server Appliance Authentication service must be enabled before a RADIUS setup can be configured. For more information about enabling the Authentication service, see  Manual settings in the Configuration Tool.

Setting up a RADIUS client

Configure your RADIUS client to send requests to the OneSpan Authentication Server Appliance IP address, using the default RADIUS port:

• For authentication requests, the default RADIUS port is 1812 (UDP).
• For accounting requests, the default RADIUS port is 1813 (UDP).

The port can be changed on OneSpan Authentication Server Appliance if necessary. Navigate to OneSpan Authentication Server > RADIUS Communicator.

To create a client component record (RADIUS client)

1. Log on to the OneSpan Authentication Server Administration Web Interface (see  Accessing OneSpan Authentication Server Appliance Configuration Tool and OneSpan Authentication Server Administration Web Interface).
2. Select CLIENTS > Register.

3. Enter the required settings for the new client component:

   • Client Type: RADIUS Client
   • Location: The IP address of the RADIUS client.
   • Policy ID: The policy you want to use for this client component, e.g. Identikey Local Authentication.
   • Protocol ID: RADIUS
   • Shared Secret: The shared secret used by the RADIUS client.
4. Click CREATE.

Optionally modifying policies and settings using the Administration Web Interface

The illustrated example configures authenticator authentication only in the assigned policy. Other authentication settings (e.g. local or back-end authentication) and authentication options (e.g. grace period, assignment methods) can also be configured. For more information about the possible policy settings, refer to the OneSpan Authentication Server Appliance Product Guide, Section "Policies". For a reference of the pre-loaded default policies, refer to the OneSpan Authentication Server Appliance Administrator Reference.

For more information about different policy options with examples using the RADIUS Client Simulator, see Test scenarios.