Aaa Authorization And Accounting - Edge-Core ECS4510-12PD Web Management Manual

Chapter 12
| Security Measures

AAA Authorization and Accounting

AAA Authorization and Accounting
Note: The priority of execution for the filtering commands is Port Security, Port
Authentication, Network Access, Web Authentication, Access Control Lists, IP
Source Guard, and then DHCP Snooping.
The authentication, authorization, and accounting (AAA) feature provides the main
framework for configuring access control on the switch. The three security
functions can be summarized as follows:
◆
Authentication — Identifies users that request access to the network.
◆
Authorization — Determines if users can access specific services.
◆
Accounting — Provides reports, auditing, and billing for services that users
have accessed on the network.
The AAA functions require the use of configured RADIUS or TACACS+ servers in the
network. The security servers can be defined as sequential groups that are applied
as a method for controlling user access to specified services. For example, when the
switch attempts to authenticate a user, a request is sent to the first server in the
defined group, if there is no response the second server will be tried, and so on. If at
any point a pass or fail is returned, the process stops.
The switch supports the following AAA features:
◆
Accounting for IEEE 802.1X authenticated users that access the network
through the switch.
◆
Accounting for users that access management interfaces on the switch through
the console and Telnet.
◆
Accounting for commands that users enter at specific CLI privilege levels.
◆
Authorization of users that access management interfaces on the switch
through the console and Telnet.
To configure AAA on the switch, you need to follow this general process:
1.
Configure RADIUS and TACACS+ server access parameters. See
Local/Remote Logon Authentication" on page
2.
Define RADIUS and TACACS+ server groups to support the accounting and
authorization of services.
– 248 –
"Configuring
249.