Aaa Across Mpls L3Vpns - HP A6600 Configuration Manual

AAA allows you to manage users based on their access types:
LAN users—Users on a LAN who must pass 802.1X authentication or MAC address authentication
•
to access the network.
Login users—Users who want to log in to the router, including SSH users, Telnet users, web users,
•
FTP users, and terminal service users.
Portal users—Users who must pass portal authentication to access the network.
•
PPP users—Users who access through PPP.
•
SSL VPN users—Users who access through SSL VPN.
•
NOTE:
Web users are supported only on centralized routers.
In addition, AAA provides the following services for login users to enhance router security:
Command authorization—Enables the NAS to defer to the authorization server to determine
•
whether a command entered by a login user is permitted for the user, ensuring that login users
execute only commands they are authorized to execute. For more information, see Fundamentals
Configuration Guide.
Command accounting—Allows the accounting server to record all commands executed on the
•
router or all authorized commands successfully executed. For more information, see Fundamentals
Configuration Guide.
Level switching authentication—Allows the authentication server to authenticate users who perform
•
privilege level switching. As long as they pass level switching authentication, users can switch their
user privilege levels without logging out and disconnecting current connections. For more
information, see Fundamentals Configuration Guide.
Configure different authentication, authorization, and accounting methods for different users in a
domain. See

AAA across MPLS L3VPNs

In an MPLS L3VPN scenario where clients in different VPNs must be centrally authenticated, deploy AAA
across VPNs to enable forwarding RADIUS and HWTACACS packets across MPLS VPNs. With the AAA
across VPNs feature, the PE device at the left side of the MPLS backbone serves as a NAS and
transparently delivers the AAA packets of private users in VPN 1 and VPN 2 to the AAA servers in VPN
3 for centralized authentication, as shown in
different VPNs do not affect each other.
"Configuring AAA methods for ISP domains."
Figure 8. Authentication packets of private users in
10