Table of Contents
Advertisement
AAA Rollover Process
A WX switch attempts AAA methods in the order in which they are
entered in the configuration:
1 The first AAA method in the list is used unless that method results in an
error. If the method results in a pass or fail, the result is final and the WX
tries no other methods.
2 If the WX switch receives no response from the first AAA method, it tries
the second method in the list.
3 If the WX switch receives no response from the second AAA method, it
tries the third method. This evaluation process is applied to all methods in
the list.
If a AAA rule specifies local as a secondary AAA method, to be used if the
RADIUS servers are unavailable, and MSS authenticates a client with the
local method, MSS starts again at the beginning of the method list when
attempting to authorize the client. This can cause unexpected delays
during client processing and can cause the client to time out before
completing logon.
Local Override Exception
The one exception to the operation described in "AAA Rollover Process"
takes place if the local database is the first method in the list and is
followed by a RADIUS server group method. If the local method fails to
find a matching username entry in the local database, the WX switch tries
the next RADIUS server group method. This exception is referred to as
local override.
If the local database is the last method in the list, however, local
authentication must either accept or deny the user, because it has no
other method to roll over to.
Remote Authentication with Local Backup
You can use a combination of authentication methods. In pass-through
authentication, AAA processing is passed through the WX switch and
performed remotely by RADIUS servers. (For details, see "Using
Pass-Through" on page 293.) If RADIUS servers are unavailable, local
authentication can take place on the WX switch.
Suppose an administrator wants to rely on RADIUS servers and also wants
to ensure that a certain group of users always gets access. As shown in
the following example, the administrator can configure pass-through
AAA Tools for Network Users
287
Advertisement
Table of Contents
