HP 5120 SI Series Security Configuration Manual page 53

2. Determine the access mode or service type to be configured. With AAA, you can configure an
authorization scheme for each access mode and service type, limiting the authorization protocols
that can be used for access.
3. Determine whether to configure an authorization method for all access modes or service types.
Follow these steps to configure AAA authorization methods for an ISP domain:
To do...
Enter system view
Enter ISP domain view
Specify the default
authorization method for all
types of users
Specify the command
authorization method
Specify the authorization
method for LAN users
Specify the authorization
method for login users
Specify the authorization
method for portal users
NOTE:
The authorization method specified with the authorization default command is for all types of users and
•
has a priority lower than that for a specific access mode.
• RADIUS authorization is special in that it takes effect only when the RADIUS authorization scheme is the
same as the RADIUS authentication scheme. In addition, if a RADIUS authorization fails, the error
message returned to the NAS says that the server is not responding.
With the radius-scheme
•
[ local | none ] keyword and argument combination configured, local authorization or no authorization
is the backup method and is used only when the remote server is not available.
If you specify only the local or none keyword in an authorization method configuration command, the
•
device has no backup authorization method and performs only local authorization or does not perform
any authorization.
• The authorization information of the RADIUS server is sent to the RADIUS client along with the
authentication response message; you cannot specify a separate RADIUS authorization server. If you
use RADIUS for authorization and authentication, you must use the same scheme setting for
authorization and authentication; otherwise, the system will prompt you with an error message.
Use the command...
system-view
domain isp-name
authorization default { hwtacacs-scheme
hwtacacs-scheme-name [ local ] | local |
none | radius-scheme radius-scheme-name
[ local ] }
authorization command { hwtacacs-scheme
hwtacacs-scheme-name [ local | none ] |
local | none }
authorization lan-access { local | none |
radius-scheme radius-scheme-name [ local |
none ] }
authorization login { hwtacacs-scheme
hwtacacs-scheme-name [ local ] | local |
none | radius-scheme radius-scheme-name
[ local ] }
authorization portal { local | none |
radius-scheme radius-scheme-name
[ local ] }
radius-scheme-name
local, or hwtacacs-scheme
41
Remarks
—
—
Optional
local by default
Optional
The default authorization
method is used by default.
Optional
The default authorization
method is used by default.
Optional
The default authorization
method is used by default.
Optional
The default authorization
method is used by default.
hwtacacs-scheme-name