---

Setting Up User Authorization

Setting up terminal-server security

Setting up SNMP security

Setting up a Domain Name System (DNS)

Disabling remote management access

Password-protecting Telnet access

Understanding secure Dynamic Bandwidth Allocation

Setting up terminal-server security

When the MAX receives an analog modem, ISDN TA, or raw TCP call, it determines whether the call is PPP-encapsulated. If it is, the MAX forwards the call to the router. If the call is not PPP-encapsulated, the MAX establishes a terminal-server connection.

In Figure 6-1, a PC running SoftComm initiates an incoming modem call. The MAX directs the call to its digital modems, then forwards the call to its terminal-server software. In Figure 6-1, the MAX immediately directs the call to a Telnet host.

Figure 6-1. A remote terminal-server connection

You can customize and limit access to the terminal-server interface in the following ways:

• Turn terminal-server operation on or off.

• Specify customized prompts for remote terminal-server users.

• Restrict use of terminal-server commands and protocols.

• Restrict access to the terminal-server command line.

• Restrict Telnet, raw TCP, and Rlogin access to the terminal server.

• Permit TCP-CLEAR or Telnet dial-in access even when the RADIUS user's profile does not specify a login host.

• Set a timeout value so that users are disconnected if they have not completed logging in when the timer has elapsed.

• Disconnect a user's Telnet connection by using the session ID for the connection.

Table 6-1. terminal-server security parameters

Location	Parameters with sample values
Ethernet \> Mod Config \> TServ Options Note: The Passwd and Imm. Modem Pwd parameter values appear only when you view them with a Full Access Security profile in effect. Otherwise, they appear as *SECURE* and *password*, respectively.	TS Enabled=Yes Passwd=newcorpPW Login Prompt= Password Prompt= 3rd Prompt=Service? 3rd Prompt Seq=First Initial Scrn=Cmd Toggle Scrn=No Security=None Telnet=Yes Rlogin=No PPP=No SLIP=No Host #n Addr=0.0.0.0 Host #n Text= Immed Host=0.0.0.0 Immed Port=0 Immed Service=Telnet Imm. Modem Pwd=secure3me Imm Modem Auth=Yes

For complete information about setting up terminal-server connections in the MAX configuration interface, see the MAX Network Configuration Guide. For complete information on setting up terminal-server connections in RADIUS, see the RADIUS Configuration Guide.

Turning terminal-server operation on or off

1. Open the Ethernet > Mod Config > TServ Options menu.

2. To enable terminal-server access, set TS Enabled to Yes. To disable terminal-server access, set TS Enabled to No.

3. Save your changes.

Note: Any characters other than \n and \t that have a single backslash (\) in front of them are removed.

For example, you could enter

Welcome to\n\t\\Ascend Remote Server\\\Enter your user name:

to display the following on the terminal-server screen:

Welcome to

\\Ascend Remote Server\\

Enter your user name:

1. Set Prompt Format to Yes.

   This is the field that determines whether you are able to use the multi-line format for the terminal-server prompt. If Prompt Format is set to No, the MAX does not interpret the line feed/carriage return character or the tab character.

2. Set the Login Timeout parameter.

   This value is an integer representing a value from 0 to 300 seconds. The default value is 300 seconds.

   Users are disconnected if they have not completed logging in when the number of seconds set in the Login Timeout field has elapsed. A user has the total number of seconds indicated in the Login Timeout field to attempt a successful login. The timer begins when the login prompt appears on the terminal-server screen, and it continues (is not reset) when the user makes unsuccessful login attempts.

3. To customize the password prompt, set the Password Prompt parameter.

   This parameter specifies the prompt the terminal server displays when asking the user for his or her password. You can specify up to 80 characters. The default value is Password:.

4. Enter a prompt string in the 3rd Prompt parameter to specify a third prompt to follow the login and password prompts.

   You can specify up to 20 characters. The default value is null. If you accept the default, the MAX does not display an additional prompt.

   The remote terminal-server user can enter up to 80 characters after this prompt. The MAX passes the information the user enters to the RADIUS server as an attribute called Ascend-Third-Prompt. This attribute appears in the Access-Request packet. If the user enters more than 80 characters, RADIUS truncates the data before assigning a value to the Ascend-Third-Prompt attribute.

   The 3rd Prompt parameter does not apply if the Auth parameter has a value other than RADIUS or RADIUS/LOGOUT. If authentication occurs through a local Connection profile, and not through the RADIUS server, the MAX ignores the 3rd Prompt specification.

5. Set the 3rd Prompt Seq parameter to First or Last to specify whether the additional prompt appears at the beginning or the end of the login sequence.

   The 3rd Prompt Seq parameter works with any authentication method except Auth=None.

   The default is Last. The parameter is N/A if TS Enabled is set to No or 3rd Prompt is null.

   The third-prompt feature works slightly differently depending on whether you specify that it appear in the Last position (a prompt issued after the login and password prompts) or the First position (a prompt issued before login and password prompts). For more complete information, see Understanding how the third login prompt works.

6. Save your changes.

3rd Prompt=Password2>>

Login:

Password:

Password2>>

The third prompt feature works differently depending upon whether you select First or Last as the value of the 3rd Prompt Seq parameter.

Similarities in the way the third prompt works in either First or Last position are:

• Both settings work with any value for the Auth parameter except Auth is set to None.

• User's input is passed to RADIUS with the authentication request as the value of the Ascend-Third-Prompt RADIUS attribute.

• The First prompt appears before Login & Password prompts, the Last prompt appears after Login & Password prompt

• User's input is echoed in response to a First prompt and is not echoed in response to a Last prompt.

1. Open the Ethernet > Mod Config > TServ Options menu.

2. Set the Telnet parameter to specify whether a user can start a Telnet session.

   • Yes indicates that a user can begin a Telnet session. The default value is Yes.

   • No indicates that a user cannot begin a Telnet session.

3. Set the Rlogin parameter to specify whether a user can initiate an Rlogin session.

   • Yes indicates that a user can begin an Rlogin session.

   • No indicates that a user cannot begin an Rlogin session. The default value is No.

4. Set the PPP parameter to specify whether a client can use asynchronous PPP.

   • Yes indicates that a client can use asynchronous PPP.

   • No indicates that a client cannot use asynchronous PPP.

   The default value is No.

5. Set the SLIP parameter to specify whether a user can initiate a Serial Line IP (SLIP) session.

   SLIP is a protocol that enables your computer to send and receive IP packets over a serial link.

   • Yes indicates that a user can begin a SLIP session.

   • No indicates that a user cannot begin a SLIP session. The default value is No.

6. Save your changes.

To set up the MAX to accept dial-calls when no login server is specified, set Auth TS Secure to No in the Ethernet > Mod Config > Auth menu. The default is Auth TS Secure set to Yes, which means the MAX drops dial-in calls if there is no login server and Login-Server is Telnet or TCP-CLEAR.

Configuring per-user access to terminal-server commands

• The Answer profile affects users who do not have a Connection profile, users with a Name/Password profile, or RADIUS-authenticated users whose connections are built partly with the Answer profile

• The Connection profiles only affect individuals, each of whom can be assigned a specific Connection profile

1. Select Ethernet > Answer > Session Options or

   Ethernet > Connections > a Connection profile > Session Options

2. Specify one of the following values for Framed Only:

   • No (the default) specifies that terminal-server users connecting through this profile have unlimited access to the terminal-server commands.

   • Yes specifies that terminal-server users connecting through this profile only have access to the PPP, SLIP, CSLIP, and Quit terminal-server commands. An attempt to execute any other terminal-server command produces the following message:

     Unauthorized terminal-server Command.
     

3. Save and exit the profile.

The EventSyslog message is at the notice level and it has one of the following formats:

^DP(assword)ASCEND: "profile_name" ... for remote_IP on local_IP

ASCEND: "profile_name" ... from COM_port on local_IP

• The profile_name argument specifies the name of the activated Security profile.

• The remote_IP argument specifies the IP address of the Telnet client.

• The local_IP argument specifies the local IP address of the MAX.

• The COM_port argument specifies the COM port number for the session.

The following two messages signal that a Telnet client has enabled a Security profile:

Jan 10 10:05:17 eng-lab-141 ASCEND: "Full Access" security profile 
enabled for 206.65.212.9 on 192.168.6.141.

Jan 10 10:07:26 eng-lab-141 ASCEND: "Default" security profile enabled 
for 206.65.212.23 on 192.168.6.141.

Jan 10 10:03:52 eng-lab-141 ASCEND: "Full Access" security profile 
enabled from com port 0 on 192.168.6.141.

To use Immediate Modem service, users specify the port number configured in the Imm. Modem Port parameter when opening a Telnet session to the MAX. For example, a user can access a digital modem on port 5000 in a MAX unit named max1 by typing the following command:

telnet> open max1 5000

Understanding per-user Immediate Modem access restriction

1. Requests a login name before enabling any user to access the Immediate Modem feature.

2. Attempts to find a profile with the name provided by the user, looking first for a local Connection profile, then for a simple Name/Password profile, and finally for a RADIUS profile.

   • If the MAX finds a matching profile, it prompts the user for the password (if any) associated with the profile and verifies that the user enters the correct password.

   • If no profile matching the name provided by the user can be found, the MAX rejects the user and closes the Telnet session.

3. If the user enters the correct password, the MAX checks the Dialout-OK parameter of the appropriate profile.

   • If Dialout OK is set to Yes, the user can access the Immediate Modem feature.

   • If the user gets the password wrong or the Dialout OK parameter is set to No, the MAX rejects the user (with an appropriate message) and closes the Telnet session.

Configuring access to the Immediate Modem feature

1. Open the Ethernet > Mod Config > TServ Options menu.

2. Set TS Enabled to Yes.

   If TS Enabled is set to No, the Imm. Modem Pwd field is N/A and you cannot specify a password for the Immediate Modem feature.

3. Set the Modem Dialout parameter to specify whether the user can use this MAX unit's V.34 digital modems to dial out.

   • Modem Dialout set to Yes permits terminal-server users access to the digital modems.

   • Modem Dialout set to No denies terminal-server users access to the digital modems.

     The default value is No.

4. Set the Immediate Modem parameter to enable or disable the Immediate Modem feature.

   • Immediate Modem set to Yes enables the Immediate Modem feature.

   • Immediate Modem set to No disables the Immediate Modem feature.

     The default value is Yes.

5. Set the Imm. Modem Access parameter to specify whether the access is restricted on a global or per-user basis, or unrestricted.

   • None indicates that call restriction is disabled, and that all users can place outgoing calls.

   • Global indicates that a single password provides access to dialout (set in the Imm. Modem Pwd parameter). Any user who knows this password can place outgoing calls.

   • User (the default) indicates the MAX requires a login before any user can access the Immediate Modem dialout feature. The MAX attempts to match the user's name and password to a name and a receive password in a Connection profile, Name/Password profile, or RADIUS users profile. If the user is authenticated by matching a Name/Password profile, the Name/Password profile must point to a Connection profile for the setting of the Dialout OK parameter.

6. Specify a password in the Imm. Modem Pwd. parameter if you set Imm. Modem Access to Global,

   This parameter is N/A if Imm. Modem Access is set to None or User.

   Note: To enable unlimited access to the Immediate Modem feature, set Imm. Modem Access to None. Do not set Imm. Modem Access to Global and leave the Imm. Modem Pwd parameter null.

7. Close the Ethernet > Mod Config > TServ Options menu.

8. Open the Telco options submenu of the appropriate Connection profile.

9. Set the Dialout OK parameter to specify whether modem dialout is enabled for this Connection profile.

   • Dialout OK set to Yes specifies that the Connection profile allows modem dialout.

   • Dialout OK set to No specifies that the Connection profile does not allow modem dialout. Dialout OK set to No is the default.

Displaying a list of active terminal-server sessions

show users 

You can detect multiple concurrent sessions for the same user with the sessionActiveTable in the Ascend MIB.

Killing an active terminal-server session

kill session ID

The active Security Profile must have Edit All Calls set to Yes. If Edit All Calls is set to No, the following message appears when you issue the kill command:

Insufficient security level for that operation.

kill command requires an argument

Session 216747095 killed.

Unable to kill session 216747095.

Setting up SNMP security

A trap is a mechanism in SNMP for reporting system change in real time. To report system change, the MAX sends a traps-PDU across the Ethernet interface to the SNMP manager. A complete list specifying the events that cause the MAX to send a traps-PDU appears in the Ascend Enterprise Traps MIB.

You can set up SNMP security in the following ways:

• Specify passwords for SNMP managers with access to the MAX.

• Set up SNMP traps.

• Restrict the hosts that can issue SNMP commands.

Table 6-3. SNMP security parameters

Location	Parameters with sample values
Ethernet > Mod Config > SNMP Options	Read Comm=new-string R/W Comm=unique-string Security=Yes RD Mgr1=10.21.4.5 RD Mgr2=10.21.4.7 RD Mgr3=10.21.4.55 RD Mgr4=10.21.4.103 RD Mgr5=10.21.4.64 WR Mgr1=10.21.4.11 WR Mgr2=0.0.0.0 WR Mgr3=0.0.0.0 WR Mgr4=0.0.0.0 WR Mgr5=0.0.0.0
Ethernet > SNMP Traps > any SNMP Traps profile	Name= Alarm=Yes Port=No Security=No Comm= Dest=0.0.0.0

Password-protecting SNMP

1. Open the Ethernet > Mod Config > SNMP Options menu.

2. Set the Read Comm parameter to specify the Read community string.

   This string authenticates an SNMP manager accessing the MAX to perform read commands, that is, the Get and Get Next commands. The Get command requests information. The Get Next command enables an SNMP manager to obtain a table of information, such as a routing table. After you enter a string for the Read Comm parameter, users must supply it to use the Get and Get Next commands.

3. Set the R/W Comm parameter to specify the Read/Write community string.

   This string authenticates an SNMP manager accessing the MAX to perform read and write commands, that is, the Get, Get Next, and Set commands. The Set command enables an SNMP manager to change information maintained by the MAX. After you enter a string for the R/W Comm parameter, users must supply it to use the Get, Get Next, and Set commands. You can use the original SNMPv1 definition of the community string (a string of octets that is compared to a similar string in the receiving SNMP entity). If the string in the packet received exactly matches a community string in the receiving entity, the packet is considered "authentic."

   The defaults for SNMP v1 (without authentication) are:

   Ethernet > Mod Config > SNMP Options > Read Comm=public

   Ethernet > Mod Config > SNMP Options > R/W Comm=write

   If you wish to use SNMP authentication, you use a new version of the Read/Write community string:

   Ethernet  >  Mod_config  >  SNMP Options  >  R/W Comm=name|secretkey
   

   where:

   • name is the name you want to assign to the read-write community name.

   • secretkey is the alphanumeric key used for authentication.

   • | (vertical bar/pipe) separates the name from the secretkey.

     This setting MAX to require SNMP SET REQUEST packets to be authenticated, with secretkey as the shared (but not transmitted) secret.

     The data, time, and hash values are transmitted with the packet. This enables the management station and MAX to verify that the packet has been produced by an authorized system and that the packet not been altered or significantly delayed in transmission.

     The MD5 hash guarantees a high likelihood that only a system that knows the secret authentication key generated the packet, while the time variables guarantee a high likelihood that an attacker did not collect an authenticated packet and transmit it at a time of its own choosing, after a significant delay.

   Note: You cannot turn SNMP write off, so you must set a secret R/W Comm string. The default R/W Comm string is write. Anyone who has used an Ascend product probably knows this default string, so it does not provide any real security.

4. If you are using authenticated SNMP, configure the SNMP management station to communicate with a MAX through authenticated SNMP (as described in Configuring the SNMP manager to use SNMP authentication).

5. Save your changes.

name|secretkey

If you configure the Ascend unit to use authenticated SNMP, it does not accept packets from an SNMP management station that uses the string format without the vertical bar/pipe.

Setting up SNMP traps

1. Open the Ethernet > SNMP Traps menu.

2. Open a blank SNMP Traps profile.

3. For the Name parameter, specify the SNMP manager to which the MAX sends traps-PDUs.

   You can specify up to 31 characters. The default value is null. The value you specify becomes the name of the profile.

4. Set the Alarm parameter to specify whether the MAX sends a traps-PDU to the SNMP manager when an alarm event occurs.

   Alarm events are defined in RFC 1215 and include the following:

   • coldStart-The MAX started up from a power-off condition.

   • warmStart-The MAX started up from a power-on condition, typically by a system reset.

   • linkDown-A WAN link or Ethernet interface has gone offline.

   • linkUp-A WAN link or Ethernet interface has come online.

     You can specify either Yes or No for the Alarm parameter. Yes specifies that the MAX traps alarm events. No specifies that the MAX does not trap alarm events. The default value is Yes.

5. Set the Port parameter to specify whether the MAX traps serial host port state changes and sends traps-PDUs to the SNMP manager.

   The MAX can record the following serial host port events:

   • portInactive

   • portDualDelay

   • portWaitSerial

   • portHaveSerial

   • portRinging

   • portCollectDigits

   • portWaiting

   • portConnected

   • portCarrier

   • portLoopback

   • portAcrPending

   • portDteNotReady

     You can specify either Yes or No for the Port parameter. Yes specifies that the MAX traps serial host port state changes. No specifies that the MAX ignores serial host port state changes. The default value is No.

6. Set the Security parameter to specify whether the MAX traps these events:

   • authenticationFailure-Occurs when authentication has failed. See RFC-1215 for a full explanation of this event.

   • consoleStateChange-Occurs when a VT100, Palmtop, or Telnet port changes its state.

   • portUseExceeded-Occurs when the port exceeds the maximum number of DS0 minutes set by the MAX DS0 Mins parameter in the Port profile.

   • systemUseExceeded-Occurs when the MAX exceeds the maximum number of DS0 minutes set by the MAX DS0 Mins parameter in the System profile.

     You can specify either Yes or No for the Security parameter. Yes specifies that the MAX traps the events. No specifies that the MAX does not trap the events. The default value is No.

7. Set the Comm parameter to specify a community name.

   The string you specify becomes a password that the MAX sends to the SNMP manager when an SNMP trap event occurs. The password authenticates the sender identified by the IP address in the IP Adrs parameter.

   For the community name, you can enter an alphanumeric string of up to 31 characters. The default value is null. To turn off SNMP traps, leave the Comm parameter blank and set Dest to 0.0.0.0.

8. Set the Dest parameter to specify the IP address of the SNMP manager to which the MAX sends traps-PDUs.

   Specify an IP address in dotted decimal notation. An IP address consists of four numbers from 0 to 255, separated by periods. If a subnet mask is in use, you must specify it. Separate a subnet mask from the IP address with a slash. The default value is 0.0.0.0/0.

   The MAX ignores any digits in the IP address hidden by a subnet mask. For example, the address 200.207.23.1/24 becomes 200.207.23.0. To specify a route to a specific host, use a mask of 32.

   The Dest parameter does not apply if the MAX does not support IP (Route IP=No) or if Combinet encapsulation is in use (Encaps=COMB).

9. Save your changes.

You can specify up to five IP hosts that can read traps and other information from the Ascend unit, and five hosts that can access MIB read-write access. The MAX checks the version and community strings before making source IP address comparisons.

To restrict the hosts that can issue SNMP commands, proceed as follows:

1. Open the Ethernet > Mod Config > SNMP Options menu.

2. Make sure that the Security parameter is set to Yes.

   This parameter specifies that the MAX must compare the source IP address of packets containing SNMP commands against a list of qualified IP addresses.

3. Specify the IP addresses of hosts that have SNMP read permission.

   For example, you might enter the following settings:

   RD Mgr1=10.1.2.3
   

   RD Mgr2=10.1.2.4
   

   RD Mgr3=10.1.2.5
   

   RD Mgr4=10.1.2.6
   

   RD Mgr5=10.1.2.7
   

   If the Security parameter is set to Yes, only SNMP managers at the specified IP addresses can execute the SNMP Get and Get Next commands.

4. Specify the IP addresses of hosts that have SNMP write permission.

   For example, you might enter the following settings:

   WR Mgr1=10.9.8.1
   

   WR Mgr2=10.9.8.2
   

   WR Mgr3=10.9.8.3
   

   WR Mgr4=10.9.8.4
   

   WR Mgr5=10.9.8.5
   

   If the Security parameter is set to Yes, only SNMP managers at the specified IP addresses can execute the SNMP Get, Get Next, and Set commands.

5. Save your changes.

Setting up a Domain Name System (DNS)

DNS maintains a database of network numbers and corresponding domain names on a domain name server. When you use a symbolic name, DNS translates the domain name into an IP address, and sends it over the network. When the Internet service provider receives the message, it uses its own database to look up the username corresponding to the host number.

You can set up two types of DNS configurations:

• Global l DNS, in which you specify the DNS server(s) known to all MAX users on connected local interfaces.

• Client DNS, in which you specify the DNS server(s) known to MAX users for which a specify Connection profile has been applied.

Table 6-4. DNS parameters

Location	Parameters with sample values
Ethernet > Mod Config > DNS	Domain Name=abc.com Sec Domain Name=xyz.com Pri DNS=10.2.3.56/24 Sec DNS=10.2.3.107/24 List Attempt=No List Size=6 Client Pri DNS=101.10.10.1 Client Sec DNS=101.10.10.2 Allow as Client DNS=Yes Sec Domain Name=xyz.com
Ethernet > Connections > any Connection profile > IP Options	Client Pri DNS Client Sec DNS

Setting global DNS parameters

1. Open the Ethernet > Mod Config > DNS menu.

2. Set the Domain Name parameter to specify a primary domain name to use for lookups.

   The MAX searches for the DNS Server(s) in the Domain Name parameter first, and then in the domain specified in the Sec Domain Name parameter.

3. Set the Sec Domain Name parameter to specify a secondary domain name to use for lookups.

4. Set the Pri DNS parameter to specify the IP address of the primary domain name server for use on connected local interfaces.

   The address consists of four numbers from 0 to 255, separated by periods. The default value is 0.0.0.0. Accept this default if you do not have a domain name server.

5. Set the Sec DNS parameter to specify the IP address of the secondary domain name server for use on connected local interfaces.

   The address consists of four numbers from 0 to 255, separated by periods. The default value is 0.0.0.0. Accept this default if you do not have a secondary domain name server.

   The MAX uses the secondary server only if the primary one is inaccessible. The Sec DNS parameter applies only to Telnet and raw TCP connections running under the MAX unit's terminal-server interface.

6. Set List Attempt to Yes.

   DNS can return multiple addresses for a hostname in response to a DNS query, but it does not include information about availability of those hosts. Users typically attempt to access the first address in the list. If that host is unavailable, the user must try the next host, and so forth. However, if the access attempt occurs automatically as part of immediate services, the physical connection is torn down when the initial connection fails.

   The DNS List Attempt feature helps the MAX avoid tearing down physical links. The user can try one entry in the DNS list of hosts when logging in through Telnet from the terminal server or immediate Telnet, and, if that connection fails, the user can try each succeeding entry.

   You can specify one of the following settings:

   • Yes specifies that the MAX enables a user to try the next host in the DNS list if the first Telnet login attempt fails.

   • No turns off the List Attempt feature.

   The default value is No.

7. If you set List Attempt to Yes, set the List Size parameter.

8. The List Size parameter specifies the maximum number of hosts the MAX can list in response to a DNS query. You can specify a number from 0 to 35. The default value is 6.

1. Open the Ethernet > Connections menu.

2. Open a Connection profile

3. Open the IP Options menu.

4. Set the Client Pri DNS parameter.

5. Set the Client Sec DNS parameter.

   The default value is 0.0.0.0. Accept this default if you do not have a secondary client DNS server.

6. Set the Allow As Client DNS parameter to Yes or No.

   • Yes enables WAN clients to use local DNS servers.

   • No disables WAN clients from using local DNS servers.

     No is the default.

1. Open the Ethernet > Mod Config > DNS menu.

2. Specify your domain name.

3. Specify the IP addresses of a primary and secondary DNS server, and turn on the DNS list attempt feature. For example:

   Mod Config
           DNS
                   Domain Name=abc.com
                   Pri DNS=10.2.3.56/24
                   Sec DNS=10.2.3.107/24
                   List Attempt=Yes
   

4. Save your changes.

Disabling remote management access

1. Open the System > Sys Config menu.

2. Set Remote Mgmt to No.

3. Exit and save your changes.

Password-protecting Telnet access

1. Open the Ethernet > Mod Config menu.

2. Set the Telnet PW parameter.

   Specify up to 20 characters. Any user who initiates an incoming Telnet session to the MAX must supply this password before the Telnet session is established.

   If a user initiates the Telnet session from the WAN, the connection must first be authenticated as specified in a Connection profile.

   For additional information about restricting Telnet in the terminal-server interface. see Restricting Telnet, raw TCP, and Rlogin access to the terminal server.

3. Set the Telnet Security parameter to specify whether or not you allow a single authentication process when users initiate a telnet session.

4. Save your changes.

Understanding secure Dynamic Bandwidth Allocation

When the system adds additional channels, the MAX must authenticate each one. You can secure each circuit by one of the following methods:

Authentication method	Description
Static passwords	Before the MAX dials a new circuit, it prompts the user to enter a static, reusable password as specified in the Connection profile, Password profile, RADIUS user profile, or TACACS/TACACS+ profile. To prevent intruders from capturing the password as it travels across the WAN, you can specify that the MAX use the Challenge Handshake Authentication Protocol (CHAP). This protocol uses encryption to protect the password and verify the identity of the caller. For information about specifying a static password and requiring CHAP authentication in the MAX configuration interface, see Configuring PAP, CHAP, or MS-CHAP for PPP, MP, and MP+ calls. For information about configuring static passwords and CHAP in RADIUS, see the RADIUS Configuration Guide.
Dynamic passwords	Using PAP-TOKEN authentication, the MAX can require a user to specify a one-time-only password, generated by a security-card server, for each additional channel. For information about setting up PAP-TOKEN authentication in the MAX configuration interface, see Requesting PAP-TOKEN authentication. For information about setting up PAP-TOKEN authentication in RADIUS, see the RADIUS Configuration Guide.
Combination of static and dynamic password	In the MAX configuration interface, you can indicate that the user need only specify a dynamic password for the initial channel, and that all other channels are authenticated by CHAP. Whenever the MAX adds channels to a PPP or MP+ call using PAP-TOKEN-CHAP authentication, the calling unit sends the encrypted value of Aux Send PW (found in the Connection profile used to dial the call), and the answering unit checks this password against the value of Recv Auth (in a Connection profile) or Ascend-Receive-Secret (in a RADIUS user profile). The answering unit receives the password when the first channel of the call connects. For details about setting up PAP-TOKEN-CHAP authentication in the MAX configuration interface, see Requesting PAP-TOKEN-CHAP authentication. For information about setting up PAP-TOKEN-CHAP authentication in RADIUS, see the RADIUS Configuration Guide.
Cached passwords	You can configure the MAX to reuse a password dynamically generated during session initiation. In this case, both the user and the MAX cache the password. Then, when the MAX needs to add bandwidth, the user provides the CHAP-encrypted password automatically and the MAX uses an internal key to authenticate the additional channels. You can specify a timeout value for the cached password, or configure the MAX to maintain the password throughout the session. For details about setting up cached passwords in the MAX configuration interface, see Requesting CACHE-TOKEN authentication. For information about setting up cached passwords in RADIUS, see the RADIUS Configuration Guide.

---

Copyright © 1998, Ascend Communications, Inc. All rights reserved.