Overview of RADIUS transactions

What this section contains

The information in this section helps you understand how to program a RADIUS server for NetApp vendor-specific RADIUS extensions so that your RADIUS servers can

Process requests from the NetCache appliance
Send the correct response to the NetCache appliance so that the appliance takes the action that you intend

Enabling IP authentication on the appliance informs the appliance to support all NetApp vendor-specific attributes described in this chapter. You determine which attributes to program on your RADIUS server in order to meet your requirements.

To understand what you need to program on your RADIUS servers to support NetApp RADIUS extensions, it is helpful to compare a standard RADIUS transaction and a transaction in which NetApp RADIUS extensions are used.

Standard RADIUS transaction

The following illustration shows a standard RADIUS transaction.

With a standard RADIUS transaction, NetCache

Sends a request to a RADIUS server only if the client sends an authorization header
Sends a request to a RADIUS server to validate credentials from all client protocols (HTTP, FTP, Gopher, NNTP, RTSP, and MMS)

RADIUS transaction with NetApp vendor-specific attributes

The following illustration shows when NetApp vendor-specific attributes are used during a RADIUS transaction.

When IP authentication is enabled, NetCache sends all requests to the RADIUS server.

As the previous illustration shows, when NetCache sends the request to the RADIUS server, NetCache inserts "NetCache" as the user name and the password that is configured in the IP Authentication Password option on the appliance. NetCache also sends Vendor-Netapp-2 and the client IP address.

The RADIUS server response can take a variety of forms, as the following table shows.

If the response is...	The response contains...
Access-reject:	Vendor-Netapp-3 (reject-type)
Access-accept:	The response must contain Session ID User name The response can contain either of the following also: Vendor-Netapp-4 (new host name) Vendor-Netapp-5 (new URL) If RTMON is used in conjunction with RADIUS extensions, the application server can use the session ID to share information with the RADIUS server.

If the response is...

The response contains...

Access-reject:

Vendor-Netapp-3 (reject-type)

Access-accept:

The response must contain

Session ID
User name

The response can contain either of the following also:

Vendor-Netapp-4 (new host name)
Vendor-Netapp-5 (new URL)

If RTMON is used in conjunction with RADIUS extensions, the application server can use the session ID to share information with the RADIUS server.

RADIUS server requirements

Configure the same password on the RADIUS server that is configured in the IP Authentication Password option on the appliance. This password enables the RADIUS server to authenticate to the appliance. (To access the IP Authentication Password option, select on the Setup tab > Authentication > RADIUS > Extensions tab in the Appliance Manager.)

You must program the RADIUS server as follows:

The RADIUS server must recognize the Vendor-Netapp-2 attribute and send the Vendor-Netapp-3 attribute.
If you are using the Send URL option on the RADIUS page in the Appliance Manager, the RADIUS server must recognize the Vendor-Netapp-1 attribute.
If you want the RADIUS server to rewrite client requests to alternative contents, the RADIUS server must be able to send the Vendor-Netapp-4 or Vendor-Netapp-5 attribute with Access-Accept responses.