Huawei Quidway S5600 Series Operation Manual page 548

Operation Manual – AAA & RADIUS & HWTACACS & EAD
Quidway S5600 Series Ethernet Switches-Release 1510
Table 1-8 Configure separate AAA schemes
Operation
Enter system view
Create an ISP domain or
enter the view of an
existing ISP domain
Configure
authentication
for the ISP domain
Configure
authorization scheme for
the ISP domain
Configure an accounting
scheme
domain
Note:
If a bound AAA scheme is configured as well as the separate authentication,
authorization and accounting schemes, the separate ones will be adopted in
precedence.
RADIUS scheme and local scheme do not support the separation of authentication
and authorization. Therefore, pay attention when you make authentication and
authorization configuration for a domain: if the scheme radius-scheme or scheme
local command is executed, the authorization none command is executed, while
the authentication command is not executed, the authorization information
returned from the RADIUS or local scheme still takes effect.
1.3.5 Configuring Dynamic VLAN Assignment
The dynamic VLAN assignment feature enables a switch to dynamically add the switch
ports of successfully authenticated users to different VLANs according to the attributes
assigned by the RADIUS server, so as to control the network resources that different
users can access.
system-view
domain isp-name
authentication
{
an
radius-scheme-name [ local ] |
scheme
hwtacacs-scheme
hwtacacs-scheme-name [ local ]
| local | none }
an authorization
hwtacacs-scheme
hwtacacs-scheme-name }
accounting
radius-scheme
for the ISP radius-scheme-name
hwtacacs-scheme
hwtacacs-scheme-name }
Huawei Technologies Proprietary
Chapter 1 AAA & RADIUS & HWTACACS
Command
radius-scheme
{ none
{ none
1-18
Configuration
Description
—
Required
Optional
By default, no
separate
authentication
scheme is
configured.
Optional
By default, no
|
separate
authorization
scheme is
configured.
Optional
|
By default, no
|
separate
accounting scheme
is configured.