Aaa; Chapter 59 Aaa; Aaa Overview - ZyXEL Communications OLT2406 User Manual

Chapter 59 AAA

C 59
H A P T E R

AAA

59.1 AAA Overview

Use these commands to configure authentication, authorization and accounting on the OLT.
Authentication, Authorization, Accounting (AAA)
Authentication is the process of determining who a user is and validating access to the system. The
system can authenticate users who try to log in based on user accounts configured on the system itself.
The system can also use an external authentication server to authenticate a large number of users.
Authorization is the process of determining what a user is allowed to do. Different user accounts may
have higher or lower privilege levels associated with them. For example, user A may have the right to
create new login accounts on the system but user B cannot. The system can authorize users based on
user accounts configured on the system itself or it can use an external server to authorize a large
number of users.
Accounting is the process of recording what a user is doing. The system can use an external server to
track when users log in, log out, execute commands and so on. Accounting can also record system
related actions such as boot up and shut down times of the system.
The external servers that perform authentication, authorization and accounting functions are known as
AAA servers. The system supports RADIUS (Remote Authentication Dial-In User Service) and TACACS+
(Terminal Access Controller Access-Control System Plus) as external authentication and accounting
servers. The system supports TACACS+ as external authorization server only.
Local User Accounts
By storing user profiles locally on the OLT, your OLT is able to authenticate and authorize users without
interacting with a network authentication server. However, there is a limit on the number of users you
may authenticate in this way.
RADIUS and TACACS+
RADIUS and TACACS+ are security protocols used to authenticate users by means of an external server
instead of (or in addition to) an internal device user database that is limited to the memory capacity of
the device. In essence, RADIUS and TACACS+ authentication both allow you to validate an unlimited
number of users from a central location.
OLT2406 User's Guide
460