What You Need To Know; Aaa Screens - ZyXEL Communications XGS2210-28 User Manual

• Use the AAA Setup screen
accounting settings, such as the methods used to authenticate users accessing the Switch and which
database the Switch should use first.

25.1.2 What You Need to Know

Authentication is the process of determining who a user is and validating access to the Switch. The
Switch can authenticate users who try to log in based on user accounts configured on the Switch itself.
The Switch can also use an external authentication server to authenticate a large number of users.
Authorization is the process of determining what a user is allowed to do. Different user accounts may
have higher or lower privilege levels associated with them. For example, user A may have the right to
create new login accounts on the Switch but user B cannot. The Switch can authorize users based on
user accounts configured on the Switch itself or it can use an external server to authorize a large number
of users.
Accounting is the process of recording what a user is doing. The Switch can use an external server to
track when users log in, log out, execute commands and so on. Accounting can also record system
related actions such as boot up and shut down times of the Switch.
Local User Accounts
By storing user profiles locally on the Switch, your Switch is able to authenticate and authorize users
without interacting with a network AAA server. However, there is a limit on the number of users you may
authenticate in this way (See
RADIUS and TACACS+
RADIUS and TACACS+ are security protocols used to authenticate users by means of an external server
instead of (or in addition to) an internal device user database that is limited to the memory capacity of
the device. In essence, RADIUS and TACACS+ authentication both allow you to validate an unlimited
number of users from a central location.
The following table describes some key differences between RADIUS and TACACS+.
Table 101 RADIUS vs. TACACS+
Transport
Protocol
Encryption

25.2 AAA Screens

The AAA screens allow you to enable authentication and authorization or both of them on the Switch.
First, configure your authentication server settings (RADIUS, TACACS+ or both) and then set up the
authentication priority, activate authorization.
Click Advanced Application > AAA in the navigation panel to display the screen as shown.
Chapter 25 AAA
(Section 25.5 on page
Section 45.4 on page
RADIUS
UDP (User Datagram Protocol)
Encrypts the password sent for
authentication.
XGS2210 Series User's Guide
255) to configure authentication, authorization and
442).
TACACS+
TCP (Transmission Control Protocol)
All communication between the client (the Switch)
and the TACACS server is encrypted.
251