Subject: (radius) Firewalls with RADIUS-based authentication?

From: Jana Dunn <[email-masked]>
Date: Thu, 1 Oct 1998 15:10:42 -0700 (PDT)

Greetings,

We're working on a project to provide authentication
for outgoing/Internet-bound connections from 
(TCP/IP-connected) student computer labs.

Ideally, we'd like a student to be able to walk into a lab,
fire up a web browser, telnet, ftp, or a similar application,
be challenged for login/password authentication, and then,
providing he is able to authenticate, be allowed to connect
to the target server and go about his business on the Internet.

We have fairly extensive RADIUS authentication databases
already in use for our modem banks, and so we'd like to use
RADIUS for the lab authentication as well.

We've looked at Firewall-1 from Sun, and are looking at PIX from
Cisco.  For various reasons, we're not entirely happy with either
product.  Are there other firewall or firewall-type products we
could use to provide RADIUS-based authentication for our project?

---------------------------

Here's what we'd like to see:

The machines in the lab may or may not be connected to a fileserver,
so we don't want a solution that's dependent on the existence of
a fileserver.

If the lab is the "inside" and the rest of the Internet (including
the rest of our campus network) is "outside", we need the RADIUS
servers to be on the outside of the firewall.

We have more than one RADIUS server and so require RADIUS-to-RADIUS
proxy.  We very much prefer the "user@realm" syntax.

We would like the user to be able to authenticate for a reasonable
session.  For example, re-authenticating for connecting to each
http server he accesses during a surfing session seems inconvenient
to us.

We'd like the authentication challenge/method to be relatively intuitive.

We would like to be able to do URL filtering with a subscription-based
product.  The server for the product needs to reside on the "outside"
of the firewall.  URL filtering is not an absolute requirement.

We would prefer a UNIX-based server/firewall or a standalone/special purpose 
firewall (like PIX.)

---------------------------

If you know of a product we should look at, please email me with
the relevant info.  

Thank you.

Jana Dunn
Telecom Analyst
University of Nevada System
[email-masked]

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.