<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2650.12">
<TITLE>RE: telnet vs ssh on Core equipment , looking for reasons why ?</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>Actually, we do this now for our VPN users. Cisco Secure ACS 2.6 for NT</FONT>
<BR><FONT SIZE=2>proxies authentication requests to an ACE/Server 5.0 (works with 4.1 as</FONT>
<BR><FONT SIZE=2>well). Fairly stright forward to set up. I believe you can get evals of both</FONT>
<BR><FONT SIZE=2>products. Both servers have replication partners for redundancy and sit in a</FONT>
<BR><FONT SIZE=2>firewall DMZ. VPN users must log into a VPN web site using their tokens to</FONT>
<BR><FONT SIZE=2>obtain the VPN client. </FONT>
</P>
<P><FONT SIZE=2>Gonna try this with our routers RSN.</FONT>
</P>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: Mike Hoskins [<A HREF="mailto:mike@TELEVOKE.COM">mailto:mike@TELEVOKE.COM</A>]</FONT>
<BR><FONT SIZE=2>Sent: Tuesday, July 31, 2001 4:04 PM</FONT>
<BR><FONT SIZE=2>To: Grace, Terry</FONT>
<BR><FONT SIZE=2>Subject: Re: telnet vs ssh on Core equipment , looking for reasons why ?</FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2>I've been thinking of doing precisely this... Any pointers to info on</FONT>
<BR><FONT SIZE=2>something like this? I haven't researched it much yet (busy with IDS</FONT>
<BR><FONT SIZE=2>atm).</FONT>
</P>
<P><FONT SIZE=2>Thanks,</FONT>
<BR><FONT SIZE=2>-Mike</FONT>
</P>
<P><FONT SIZE=2>> "Grace, Terry" wrote:</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> Here's an alternative that might work. Authenticate via Radius which</FONT>
<BR><FONT SIZE=2>> in turn proxies the authentication request to a SecurId server. With</FONT>
<BR><FONT SIZE=2>> one time passwords, who cares if they get sniffed? You also get the</FONT>
<BR><FONT SIZE=2>> benefit of having your Radius server being able to do</FONT>
<BR><FONT SIZE=2>> accounting/access control on the sessions as well.</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> -----Original Message-----</FONT>
<BR><FONT SIZE=2>> From: Dave Israel [<A HREF="mailto:davei@biohazard.demon.digex.net">mailto:davei@biohazard.demon.digex.net</A>]</FONT>
<BR><FONT SIZE=2>> Sent: Tuesday, July 31, 2001 2:43 PM</FONT>
<BR><FONT SIZE=2>> To: alex@yuriev.com</FONT>
<BR><FONT SIZE=2>> Cc: nanog@merit.edu</FONT>
<BR><FONT SIZE=2>> Subject: RE: telnet vs ssh on Core equipment , looking for reasons why</FONT>
<BR><FONT SIZE=2>> ?</FONT>
</P>
</BODY>
</HTML>