RADIUS over TLS (RADSEC)
To use 802.1X or MAC RADIUS authentication, you must specify the connections on the switch for each RADIUS server to which you will connect. RADIUS over TLS is designed to provide secure communication of RADIUS requests using the Transport Secure Layer (TLS) protocol. RADIUS over TLS, also known as RADSEC, redirects regular RADIUS traffic to remote RADIUS servers connected over TLS. RADSec allows RADIUS authentication, authorization and accounting data to be passed safely across untrusted networks.
RADSEC uses TLS in combination with the Transmission Control Protocol (TCP). This transport profile provides stronger security than the User Datagram Protocol (UDP) which was originally used for RADIUS transmission. RADIUS over UDP encrypts the shared secret password using the MD5 algorithm, which is vulnerable to attacks. RADSEC mitigates the risk of attacks on MD5 by exchanging RADIUS packet payloads over an encrypted TLS tunnel.
Due to limitations of the TCP protocol, RADSEC can have no more than 255 RADIUS messages in flight.
Configure the RADSEC Destination
RADSEC servers are represented by RADSEC destination objects. To configure RADSEC, you must define the RADSEC server as a destination, and direct RADIUS traffic to that destination.
You define the RADSEC server as a destination using the
radsec
statement at the [edit access] hierarchy level.
RADSEC destinations are identified by a unique numeric ID. You can configure
multiple RADSEC destinations with different parameters pointing to the same
RADSEC server.
To redirect traffic from a standard RADIUS server to a RADSEC server, associate
the RADIUS server with a RADSEC destination. For example, the RADIUS server
10.1.1.1
is associated with RADSEC destination 10:
access {
radius-server 10.1.1.1 {
secret zzz;
radsec-destination 10;
}
}
You can also associate the RADIUS server with a RADSEC destination inside an
access profile. For example, RADIUS server
10.2.2.2
in profile acc_profile is associated with RADSEC destination
10:
access {
profile acc_profile {
secret zzz;
radsec-destination 10;
}
}
You can redirect more than one RADIUS server to the same RADSEC destination.
To configure RADSEC:
Configure TLS Connection Parameters
The TLS connection provides encryption, authentication, and data integrity for the exchange of RADIUS messages. TLS relies on certificates and private-public key exchange pairs to secure the transmission of data between the RADSEC client and server. The RADSEC destination uses local certificates that are dynamically acquired from the Junos PKI infrastructure.
To enable RADSEC, you must specify the name of the local certificate. For information on configuring the local certificate and certificate authority (CA), see Configuring Digital Certificates.
Example: Simple RADSEC Configuration
The following example is a simple RADSEC configuration with one RADIUS server and one RADSEC destination. RADIUS traffic is redirected from RADIUS server 10.1.1.1 to RADSEC destination 10.
access {
radius-server 10.1.1.1 {
secret zzz;
radsec-destination 10;
}
radsec {
destination 10 {
address 10.10.1.1;
max-tx-buffers 1000;
id-reuse-timeout 30;
port 1777;
source-address 10.1.1.2;
tls-certificate my_cert;
tls-min-version { v1.1 | v1.2 };
tls-peer-name x0.radsec.com
tls-timeout 10;
}
}
}
Monitoring Certificates
To view information about the state and statistics of local certificate acquisition: show network-access radsec local-certificate.
Monitoring RADSEC Destinations
To view statistics for the RADSEC destinations: show network-access radsec statistics.
To view the state of the RADSEC destinations: show network-access radsec state.