cisco2800 VPNclient support with radius auth

[Riccardo Veraldi]

Hello,

I enabled VPNclient support on my cisco 2811 and users are authenticated using external radius authentication.

Everything works.

The radius server is freeradius.

I would like to ask if connection between cisco 2811 router and radius server is encrypted or if user authentication data

is cleartext on the wire ?

thank you

Riccardo

[Yudong Wu]

Radius only encrypts the passoword.

http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a0080094e99.shtml

RADIUS encrypts only the password in the access-request packet, from       the client to the server. The remainder of the packet is unencrypted. Other       information, such as username, authorized services, and accounting, can be       captured by a third party.

TACACS+ encrypts the entire body of the packet but leaves a standard       TACACS+ header. Within the header is a field that indicates whether the body is       encrypted or not. For debugging purposes, it is useful to have the body of the       packets unencrypted. However, during normal operation, the body of the packet       is fully encrypted for more secure communications.