Basic Aaa Configuration Steps; Overview Of Aaa Configuration Steps - D-Link xStack DGS-3610 Series Configuration Manual

DGS-3610 Series Configuration Guide
The figure above illustrates a typical AAA network configuration, including two security
servers: R1 and R2 are both RADIUS servers.
Suppose the system administrator has defined a method list, R1 is used first to capture the
identity information, then R2, and finally the local username database on the NAS. If a
remote PC user attempts to access the network via dial-up, the NAS first queries the
authentication information from R1. If the user passes the authentication on R1, R1 sends a
SUCCESS reply to the NAS, and thus the user's access to the network is allowed. If R1
returns FAIL reply, the user's access is refused and the disconnected. If R1 has no reply, the
NAS regards it as ERROR and queries authentication information from R2. This process
continues for the remaining methods till the user passes the authentication or is refused or
the session is terminated. If ERROR is returned for all methods, the authentication fails and
the user is disconnected.
Caution

37.5 Basic AAA Configuration Steps

First you must choose a security solution, evaluate the potential security risks in the specific
network and select the proper measures to prevent unauthorized accesses. For the security
risk evaluation and the possible security solutions, see Chapter 2, Security Overview. We
recommend the use of AAA as much as possible to guarantee network security.
37.5.1

Overview of AAA Configuration Steps

The AAA configuration may become simple when the basic operation process of AAA is
understood.On DGS-3610 series, the AAA is configured through the following steps:
1. Enable AAA with the global configuration command aaa new-model.
2. Configure the security protocol parameters if you decide to use the security server, such
as RADIUS.
3. Define the authentication method list by using the aaa authentication command.
4. Apply the method list on specific interface or line, if necessary.
Caution
The REJECT response is not the same as the TIMEOUT response.
REJECT means the user fails to comply with the standard in the available
authentication database and does not pass the authentication, thus the
access request will be refused. TIMEOUT means there is no reply from the
security server to the authentication. When a TIMEOUT is detected, the
AAA selects the next authentication method in the method list to continue
the authentication process.
When the specific method list is applied, the default authentication method
list is applied if no named method list is clearly specified.
As a result, if you do not want to use the default authentication method list,
you shall specify a specific method list.
Chapter 37 Configuration of 802.1X
37-3