The NAS and the RADIUS authentication server/accounting server have
a shared secret which is used to provide authentication of the
response packets from the server. The RADIUS Internet Drafts
specify that the NAS can, if no answer is received from the
primary server, attempt to contact an alternate server.
My question is:
Is it expected that the NAS use different shared secrets when
contacting different servers (ie when contacting an alternate
authentication server after the primary auth server fails to
respond)? Or is one shared secret on the NAS considered
sufficient for contacting all authentication and accounting
servers?
If anyone can clue me in on how their site handles this issue
of shared secrets, or if there is a standard accepted answer
to the above question, I will greatly appreciate it!
Thanks in advance,
Ed Macke
Network Engineer
Meridian Technology Corporation
ed@meridiantc.com