Aaa For Mpls L3Vpns; Protocols And Standards - HP 10500 Series Configuration Manual

In addition, AAA provides the following services for login users to enhance device security:
• Command authorization—Enables the NAS to defer to the authorization server to determine
whether a command entered by a login user is permitted, ensuring that login users execute only
commands they are authorized to execute. For more information about command authorization, see
Fundamentals Configuration Guide.
Command accounting—Allows the accounting server to record all commands executed on the
•
device or all authorized commands successfully executed. For more information about command
accounting, see Fundamentals Configuration Guide.
Level switching authentication—Allows the authentication server to authenticate users who perform
•
privilege level switching. As long as they pass level switching authentication, users can switch their
user privilege levels without logging out and disconnecting current connections. For more
information about user privilege level switching, see Fundamentals Configuration Guide.
You can configure different AAA methods for different types of users in a domain. See
methods for ISP

AAA for MPLS L3VPNs

In an MPLS L3VPN scenario where clients in different VPNs are centrally authenticated, you can deploy
AAA across VPNs to enable forwarding of RADIUS and HWTACACS packets across MPLS VPNs. With
this feature, the PE at the left side of the MPLS backbone serves as a NAS and transparently delivers the
AAA packets of private users in VPN 1 and VPN 2 to the AAA servers in VPN 3 for centralized
authentication, as shown in
affect each other.
Figure 8 Network diagram
NOTE:
This feature can help a multi-VPN-instance CE to implement portal authentication for VPNs. For more
information about multi-VPN-instance CEs, see
portal authentication, see

Protocols and standards

The following protocols and standards are related to AAA, RADIUS, and HWTACACS:
• RFC 2865, Remote Authentication Dial In User Service (RADIUS)
RFC 2866, RADIUS Accounting
•
domains."
Figure 8. Authentication packets of private users in different VPNs do not
"Configuring portal
MPLS Configuration Guide
authentication."
10
"Configuring AAA
. For more information about