Hi community!
Today, Let's talk about the HWTACACS protocol. If you have any comments, please point them out in the comments section and I will revise the article.
What Is HWTACACS?
HWTACACS is an authentication protocol developed by Huawei. It is similar to RADIUS authentication. However, HWTACACS uses TCP transmission. Therefore, HWTACACS is more secure than RADIUS authentication. The HWTACACS protocol also uses the common client/server (C/S) architecture and uses TCP port 49. HWTACACS uses authentication, accounting, and authorization packets in the AAA protocol. The Huawei device functions as the authentication client and sends the user name and password to the server for authentication. After the user is authenticated and authorized, the user can log in to the device and perform operations. According to the document, the HWTACACS protocol is enhanced based on the TACACS (RFC 1492). So what is this enhancement? See the end.
Packet and Authentication Process
Authentication packets:
Authentication start packet: sent by the client to the server to initiate an authentication request.
Authentication response packets: sent by the server to the client to request the user name and password.
Authentication Continuity packet: sent by the client to the server to respond to the account and password requested by the server.
Authorization packet:
Authorization request packet: sent by the client to the server to request the authorization result of the server.
Authorization response packets: sent by the server to the client to obtain the request result of the client.
Accounting packets:
Accounting-Request packets: sent by the client to the server to request accounting start.
Accounting-response packets: sent by the server to the client for corresponding requests.
Authentication Process
HWTACACS VS Radius VS TACACS
Q: What is the enhanced function of the HWTACACS protocol?
A: Document description: "The main difference between the two protocols is that the meanings or types of attributes carried in authorization and accounting packets are different." I compared the packet structure and found that the packet structure was the same, but the interpretation of a certain packet field was different. For example, an authorization request packet is used as an example.
Arg_cnt
Tacacs: indicates the number of parameters.
HWtacacs: indicates the number of attributes carried in authorization request packets.
ArgN
Tacacs: parameter length.
HWtacacs: specifies the attributes of authorization request packets, including cmd and cmd-arg.
thanks 
