Chapter 5: Selection & Interfaces

5.1 Core Product Introduction

The six core product categories form the foundation of every enterprise identity authentication system. Each category serves a distinct function in the authentication chain, from directory services and certificate issuance to network enforcement and audit logging. The following product showcase illustrates representative appliances from each category, with key specifications and deployment roles.

Figure 5.1: Core Product Showcase — Six product categories: RADIUS/AAA Server (1U rack), Network Access Control appliance (2U rack), PKI/CA Server (rack), Enterprise Access Switch (802.1X capable), Wireless Controller (1U), and PAM Jump Server (rack)

5.2 Typical Wiring and Interface Logic

The interface logic diagram illustrates the physical port layout of the RADIUS/AAA server and its logical connections to all integrated systems. Understanding the interface mapping is essential for firewall rule creation, network segmentation, and troubleshooting. Each interface serves a specific function, and mixing authentication traffic with management traffic on the same interface is a security anti-pattern that must be avoided.

Figure 5.2: RADIUS Server Interface and Connection Logic — Front panel ports (MGMT, AUTH1 UDP 1812, ACCT UDP 1813, CoA UDP 3799, LDAP TCP 389/636) with logical connections to AD/LDAP, PKI/CA (OCSP), Switches/APs (RADIUS), SIEM (Syslog TLS 6514), and NTP (UDP 123)

5.3 Core Product Function Comparison

The following tables provide detailed function comparisons across the key product categories. These comparisons are designed to support procurement decisions by highlighting the functional differences between product tiers and vendors. Organizations should evaluate products against their specific scenario requirements identified in Chapter 3, using these tables as a structured scoring framework.

5.3.1 RADIUS/AAA Server Feature Matrix

5.3.2 NAC Platform Feature Matrix

5.3.3 PAM Platform Feature Matrix