CN102594684A

CN102594684A - RADIUS message processing method and network access device

Info

Publication number: CN102594684A
Application number: CN2012100370866A
Authority: CN
Inventors: 靳康; 林华云
Original assignee: ZTE Corp
Current assignee: ZTE Corp
Priority date: 2011-11-28
Filing date: 2012-02-17
Publication date: 2012-07-18
Anticipated expiration: 2032-02-17
Also published as: CN102594684B

Abstract

The invention provides an RADIUS message processing method and a network access device. The method comprises the following steps that: a first device receives an access request of a client side according to a virtual router redundancy protocol; and the first device transmits an access request message to an RADIUS server. The method can realize a hot backup function of the RADIUS message, and the access control on users in an RADIUS mode cannot be influenced even if one of the devices or certain port has fault.

Description

A kind of processing method of RADIUS message and network access equipment

Technical field

The present invention relates to the communications field, specifically, relate to a kind of processing method and network access equipment of RADIUS message.

Background technology

RADIUS (Remote Authentication Dial In User Service; The remote customer dialing authentication system) is a kind of AAA (Authentication, Authorization, Accounting; Checking, authorization and accounting) the network application agreement of type, be used for functions such as authentication.This agreement has realized the Long-distance Control for user's access.

Virtual Router Redundancy Protocol (VRRP) is a kind of selection agreement, and it can be in the VRRP router of the responsibility dynamic assignment of a virtual router to the local area network (LAN).The VRRP router of control virtual router ip address is called active router, and it is responsible for transmitting packet to these virtual ip address.In case active router is unavailable, this selection course just provides dynamic failover mechanisms, and this just allows the IP address of virtual router to can be used as acquiescence first hop router of end host.The benefit of using VRRP is the availability of higher default path is arranged and to need not configuration dynamic routing or route discovery protocols on each end host.VRRP seals to be contained in the IP bag and sends.In commercial environment, need to guarantee that the heat of RADIUS message is equipped with, even a link breaks down, do not influence user's functions such as access authentication and mandate yet.And the heat that does not have the radius client message at present is equipped with technology; Prior art can only realize the cold standby technology of radius client message; This technological deficiency is: when link broke down, new calling can only be initiated in the terminal, had sent the RADIUS request message before and can't return; Can cause user's overtime failure of reaching the standard grade, also can cause the inconsistent problem of radius server User Status.

Summary of the invention

The technical problem that the present invention will solve provides a kind of processing method and network access equipment of RADIUS message, to realize the hot-backup function of RADIUS message.

In order to solve the problems of the technologies described above, the invention provides the processing method of a kind of remote customer dialing authentication system (RADIUS) message, comprising:

First equipment receives the access request of client according to Virtual Router Redundancy Protocol;

First equipment sends to radius server and inserts request message.

Further, said method also has following characteristics: also comprise:

First equipment receives the access response message of said radius server;

Destination interface according to said access response message carries is handled said access response message.

Further, said method also has following characteristics: said destination interface information of carrying according to said access response message is handled said access response message and is comprised:

First equipment judges whether said destination interface is consistent with the port of this locality configuration; If it is consistent; Then said access response message is resolved,, then said access response message is transmitted to second equipment if inconsistent; Wherein, first equipment has identical virtual address and different port informations with second configuration of devices.

Further, said method also has following characteristics: said before radius server sends the access request message, also comprise:

Source address in the said access request message is extended this as said virtual address, the source port in the said access request message is extended this as local pre-configured port information.

In order to address the above problem, the present invention also provides a kind of network access equipment, comprising:

Receiver module is used for receiving according to Virtual Router Redundancy Protocol the access request of client;

Sending module is used for sending the access request message to radius server.

Further, above-mentioned network access equipment also has following characteristics: also comprise processing module,

Said receiver module also is used to receive the access response message of said radius server;

Said processing module, the destination interface that is used for carrying according to said access response message is handled said access response message.

Further, above-mentioned network access equipment also has following characteristics: said processing module comprises:

Judging unit is used to judge whether said destination interface is consistent with the port of this locality configuration;

Resolution unit is used under the situation of said judgment unit judges unanimity, said access response message being resolved;

Retransmission unit is used under the inconsistent situation of said judgment unit judges, said access response message being transmitted to the particular network access device;

Wherein, virtual address that said network access equipment is identical with disposing of said particular network access device and different port informations.

Further, above-mentioned network access equipment also has following characteristics:

Said sending module also was used for before radius server sends the access request message, and the source address in the said access request message is extended this as said virtual address, and the source port in the said access request message is extended this as local pre-configured port information.

Further, above-mentioned network access equipment also has following characteristics: also comprise,

Configuration module, being used for the port arrangement that connects client is to launch the attribute of Virtual Router Redundancy Protocol, and port that connects client and uplink port are bound; Dispose a virtual address and port information.

To sum up, the present invention provides a kind of processing method and network access equipment of RADIUS message, realizing the hot-backup function of RADIUS message, even wherein an equipment or certain port break down, does not also influence with the RADIUS mode user is carried out access control.

Description of drawings

Accompanying drawing is used to provide further understanding of the present invention, and constitutes the part of specification, is used to explain the present invention with embodiments of the invention, is not construed as limiting the invention.In the accompanying drawings:

Fig. 1 is the sketch map of the network access equipment of the embodiment of the invention;

Fig. 2 is the flow chart of processing method of the RADIUS message of the embodiment of the invention;

Fig. 3 is the network diagram of the embodiment of the invention;

Fig. 4 is the flow chart of processing method of the RADIUS message of another embodiment of the present invention.

Embodiment

For making the object of the invention, technical scheme and advantage clearer, hereinafter will combine accompanying drawing that embodiments of the invention are elaborated.Need to prove that under the situation of not conflicting, embodiment among the application and the characteristic among the embodiment be combination in any each other.

Fig. 1 is the sketch map of the network access equipment of the embodiment of the invention, and is as shown in Figure 1, and the network access equipment of present embodiment comprises:

Sending module is used for sending the access request message to radius server.

Wherein, the network access equipment of present embodiment can also comprise: processing module,

Wherein, said processing module comprises:

Wherein, Said sending module also was used for before radius server sends the access request message; Source address in the said access request message is extended this as said virtual address, the source port in the said access request message is extended this as local pre-configured port information.

The network access equipment of present embodiment can also comprise:

Fig. 2 is the flow chart of processing method of the RADIUS message of the embodiment of the invention, and as shown in Figure 2, the method for present embodiment comprises following step:

S10, first equipment receive the access request of client according to Virtual Router Redundancy Protocol;

S20, first equipment send to radius server and insert request message.

Can also comprise following step:

S30, first equipment receive the access response message of said radius server, according to the destination interface that said access response message carries said access response message are handled.

With a specific embodiment method of the present invention is carried out detailed explanation below.

Fig. 3 is the network diagram of the embodiment of the invention, and is as shown in Figure 3, and two equipment NAS (network access server) A and NAS B are equipped with as heat, to realize that any one is broken down among link A, B and link D, the E, professional unaffected.

At first; The interface enabling VRRP that is connected link D and link E of configuration device NAS A and NAS B; And bind (port that is link D is bound with the uplink port of link B, the uplink port binding of the port of link E and link A) respectively with the uplink port that is connected link A and link B; On equipment NAS A and NAS B, dispose identical RADIUS message virtual source address and different port ranges (source port of two equipment can not be identical) respectively.

NAS A and NAS B dispose same virtual address, and the port that connects link D and link E adopts the VRRP agreement, and VRRP associate device uplink port: when link A was in the state of down (unavailable), then link D master used state; When link B was in the state of down, then link E master used state.

Do routing optimization on the router, mail to preferred route to the virtual address of NAS A and NAS B.Configuration link A is different according to COST (expense) with link B on router, selects wherein one to be preferred route.

The source address of the RADIUS message that NAS A and NAS B are up extends this as this virtual address; Mail to preferred route (for example link A) by the descending RADIUS of router; NAS A inspection RADIUS message does not belong to self to be handled, and then is forwarded to NAS B through link C, and NAS B accomplishes to insert and handles.

Fig. 4 is the flow chart of processing method of the RADIUS message of another embodiment of the present invention, and is as shown in Figure 4, comprises following step:

Step 101, when user side initiate to insert request, client is according to the VRRP agreement, with inserting the device port (for example, equipment NAS A) that request sends to main usefulness;

Step 102, equipment NAS A are sent the RADIUS request message through link A, and source address and source port extend this as the value of virtual source address and source port in the step 102 in the RADIUS message;

The RADIUS response message that step 103, radius server return; Router mails to preferred route (for example, link A) with the RADIUS response message, and preferred route is come out through the COST dynamic calculation; The route that COST is little is only preferential route, and the route COST at faulty link place is infinitely great;

Step 104, equipment NAS A receive the RADIUS response message; The port value of configuration compares in destination interface that the RADIUS response message is carried and the step 102; If consistent, then directly handle the request of access, whether decision allows user's access request according to the RADIUS response message; If inconsistent, then turn to step 105;

Step 105, equipment NAS A are forwarded to equipment NAS B through link C with the RADIUS response message, handle the request of access by equipment NAS B, and whether decision allows user's access request according to the RADIUS response message.

One of ordinary skill in the art will appreciate that all or part of step in the said method can instruct related hardware to accomplish through program, said program can be stored in the computer-readable recording medium, like read-only memory, disk or CD etc.Alternatively, all or part of step of the foregoing description also can use one or more integrated circuits to realize.Correspondingly, each the module/unit in the foregoing description can adopt the form of hardware to realize, also can adopt the form of software function module to realize.The present invention is not restricted to the combination of the hardware and software of any particular form.

More than be merely the preferred embodiments of the present invention; Certainly; The present invention also can have other various embodiments; Under the situation that does not deviate from spirit of the present invention and essence thereof, those of ordinary skill in the art work as can make various corresponding changes and distortion according to the present invention, but these corresponding changes and distortion all should belong to the protection range of the appended claim of the present invention.

Claims

1. the processing method of a remote customer dialing authentication system (RADIUS) message comprises:

First equipment sends to radius server and inserts request message.

2. the method for claim 1 is characterized in that: also comprise:

First equipment receives the access response message of said radius server;

3. method as claimed in claim 2 is characterized in that: said destination interface information of carrying according to said access response message is handled said access response message and is comprised:

4. like each described method of claim 1-3, it is characterized in that: said before radius server sends the access request message, also comprise:

5. network access equipment comprises:

Sending module is used for sending the access request message to radius server.

6. network access equipment as claimed in claim 5 is characterized in that: also comprise processing module,

7. network access equipment as claimed in claim 6 is characterized in that: said processing module comprises:

8. device as claimed in claim 5 is characterized in that:

9. like each described network access equipment of claim 5-8, it is characterized in that: also comprise,