About IP authentication

Comparing IP authentication and standard RADIUS

The following table provides information about the IP authentication protocol and standard RADIUS that you need to consider when determining whether you can use IP authentication in your organization.

Consideration	IP authentication (through RADIUS extensions)	Standard RADIUS
Protocols supported	Streaming media only	All
How requests are sent	NetCache checks all requests with identified RADIUS servers.	NetCache sends a request to identified RADIUS servers only if the client sends an authorization header.

The IP authentication protocol provides the interface between a NetCache appliance and an application server. A NetCache appliance is aware of RADIUS servers but it is not aware of application servers.

Implication of all requests being sent to RADIUS servers

If you enable IP authentication, the NetCache appliance queries the RADIUS servers you have identified for every request it receives. You must ensure that the RADIUS servers that you have identified in the appliance configuration can handle the load of requests that the appliance will send to them.

Some organizations dedicate specific NetCache appliances and RADIUS servers for their e-Commerce deployments. Doing so provides a way to limit the volume of traffic sent to the appliances that would be forwarded to the RADIUS servers.

Why IP authentication is only for streaming protocols

For streaming requests, the appliance behavior of sending every request to the RADIUS servers should not be a problem for a typical RADIUS server. The reason is that with streaming, an appliance receives a relatively low number of requests per second. A NetCache appliance sends a streaming request to the RADIUS server only once per stream, regardless of the duration of the stream.

In contrast, an appliance receives a large number of HTTP requests per second. If an appliance on which IP authentication was enabled was handling HTTP requests, the appliance would query each identified RADIUS server to validate each HTTP request. Consequently, the RADIUS server probably would become overloaded by the large volume of HTTP requests.

Summary of prompting activity with IP authentication

When IP authentication is enabled, the NetCache appliance first attempts to authenticate based on client IP address. The following table summarizes the NetCache behavior after the appliance receives specific responses from the RADIUS server.

If...	Then...
Authentication by client IP address is successful.	The client is not prompted for a user name and password, and NetCache uses credentials supplied by the RADIUS server.
Authentication by client IP address is not successful.	The RADIUS server instructs NetCache to request a user name and password from the client software. If the user name and password are not valid, the client is denied.
Authentication by user, password, or the client IP address is successful but the user is denied because the user is not authorized (for example, because the account has insufficient funds or it might have expired). Authorization is determined by the application (see the scenarios later in this chapter for more details).	The client is denied.

Options for configuring IP authentication

On the appliance, you must configure both basic RADIUS options and specific options. All RADIUS options are on the Authentication - RADIUS page.

Basic options on the General tab

Configure the following:

RADIUS Enable
RADIUS Servers

Options on the Extensions tab specific to IP authentication

The following options are available for IP authentication.

If you want to...	Use these options on the appliance...
Enable the IP authentication feature	These options are always required: Use IP Authentication Protocol IP Authentication Password
Ensure that the media player does not use a user and password that it has stored	This option is optional: Always Prompt for User Name and Password
Send the URL with the request	This option is optional: Send URL See Scenario: Using the IP authentication feature for access control by URL for an example of using this option with IP authentication. This option can be used with standard RADIUS also.

If you want to...

Use these options on the appliance...

Enable the IP authentication feature

These options are always required:

Use IP Authentication Protocol
IP Authentication Password

Ensure that the media player does not use a user and password that it has stored

This option is optional:

Always Prompt for User Name and Password

Send the URL with the request

This option is optional:

Send URL

See Scenario: Using the IP authentication feature for access control by URL for an example of using this option with IP authentication. This option can be used with standard RADIUS also.