Hwtacacs Configuration Task List; Configuring Aaa; Configuration Prerequisites; Creating An Isp Domain - H3C S5120-EI Series Operation Manual

Hide thumbs Also See for S5120-EI Series:

Table of Contents

HWTACACS Configuration Task List

Creating a HWTACACS scheme

Specifying the HWTACACS Authentication Servers

Specifying the HWTACACS Authorization Servers

Specifying the HWTACACS Accounting Servers

Setting the Shared Key for HWTACACS Packets

Configuring Attributes Related to the Data Sent to HWTACACS Server

Setting Timers Regarding HWTACACS Servers

Displaying and Maintaining HWTACACS

By configuring AAA, you can provide network access service for legal users, protect the networking

devices, and avoid unauthorized access and repudiation. In addition, you can configure ISP domains to

perform AAA on accessing users.

In AAA, users are divided into LAN users (such as 802.1x users and MAC authentication users), login

users (such as SSH, Telnet, FTP, and terminal access users), portal users and command line users

(that is, command line authentication users). Except for command line users, you can configure

separate authentication/authorization/accounting policies for all the other types of users. Command line

users can be configured with authorization policy independently.

For remote authentication, authorization, or accounting, you must create the RADIUS or HWTACACS

scheme first. For RADIUS scheme configuration, refer to

scheme configuration, refer to

An Internet service provider (ISP) domain represents a group of users belonging to it. For a username in

the userid@isp-name format, the access device considers the userid part the username for

authentication and the isp-name part the domain name.

In a networking scenario with multiple ISPs, an access device may connect users of different ISPs. As

users of different ISPs may have different user attributes (such as username and password structure,

service type, and rights), you need to configure ISP domains to distinguish the users. In addition, you

need to configure different attribute sets including AAA methods for the ISP domains.

For the NAS, each user belongs to an ISP domain. Up to 16 ISP domains can be configured on a NAS.

If a user does not provide the ISP domain name, the system considers that the user belongs to the

default ISP domain.

RADIUS. For HWTACACS

Table of Contents