Which two statements regarding external authentication servers for firewall user authentication are true?