Creating An Isp Domain; Configuring Isp Domain Attributes - HP FlexNetwork 10500 Series Security Configuration Manual

"Configuring RADIUS
schemes."

Creating an ISP domain

In a networking scenario with multiple ISPs, the device can connect to users of different ISPs. These
users can have different user attributes, such as different username and password structures,
different service types, and different rights. To manage users of different ISPs, configure ISP
domains, and configure AAA methods and domain attributes for each ISP domain as needed.
The device supports up to 16 ISP domains, including the system-defined ISP domain system. You
can specify one of the ISP domains as the default domain.
On the device, each user belongs to an ISP domain. If a user does not provide an ISP domain name
at login, the device considers the user belongs to the default ISP domain.
The device chooses an authentication domain for each user in the following order:
1. The authentication domain specified for the access module.
2. The ISP domain in the username.
3. The default ISP domain of the device.
If no ISP domain is available, user authentication fails.
NOTE:
Support for the authentication domain configuration depends on the access module. You can
specify an authentication domain for 802.1X, portal, or MAC authentication.
When you configure an ISP domain, follow these restrictions and guidelines:
•
An ISP domain cannot be deleted when it is the default ISP domain. Before you use the undo
domain command, change the domain to a non-default ISP domain by using the undo domain
default enable command.
•
You can modify the settings of the system-defined ISP domain system, but you cannot delete
the domain.
To create an ISP domain:
Step
1. Enter system view.
2. Create an ISP domain and
enter ISP domain view.
3. Return to system view.
4. (Optional.) Specify the
default ISP domain.

Configuring ISP domain attributes

In an ISP domain, you can configure the following attributes:
•
Domain status—By placing the ISP domain in active or blocked state, you allow or deny
network service requests from users in the domain.
•
Authorization attributes—The device assigns the idle cut attribute in the ISP domain to the
authenticated users. The idle cut feature enables the device to check the traffic of each online
user in the domain at the idle timeout interval. The device logs out any users in the domain
schemes," "Configuring HWTACACS
Command
system-view
domain isp-name
quit
domain default enable
isp-name
43
schemes," and "Configuring LDAP
Remarks
N/A
By default, the device has a
system-defined ISP domain system.
N/A
By default, the default ISP domain is the
system-defined ISP domain system.