Aaa Across Mpls L3Vpns; Protocols And Standards - HP 12500 Series Configuration Manual

Portal users—Users who must pass portal authentication to access the network.
•
PPP users—Users who access through PPP.
•
In addition, AAA provides the following services for login users to enhance switch security:
Command authorization—Enables the NAS to defer to the authorization server to determine
•
whether a command entered by a login user is permitted for the user, making sure that login users
execute only commands they are authorized to execute. For more information about command
authorization, see Fundamentals Configuration Guide.
Command accounting—Allows the accounting server to record all commands executed on the
•
switch or all authorized commands successfully executed. For more information about command
accounting, see Fundamentals Configuration Guide.
• Level switching authentication—Allows the authentication server to authenticate users who perform
privilege level switching. As long as passing level switching authentication, users can switch their
user privilege levels, without logging out and disconnecting current connections. For more
information about user privilege level switching, see Fundamentals Configuration Guide.
You can configure different authentication, authorization, and accounting methods for different users in
a domain. See

AAA across MPLS L3VPNs

In an MPLS L3VPN scenario where clients in different VPNs need to be centrally authenticated, you can
deploy AAA across VPNs to enable forwarding RADIUS and HWTACACS packets across MPLS VPNs.
With the AAA across VPNs feature, the PE device at the left side of the MPLS backbone serves as a NAS
and transparently delivers the AAA packets of private users in VPN 1 and VPN 2 to the AAA servers in
VPN 3 for centralized authentication, as shown in
different VPNs do not affect each other. Together with the AAA across MPLS L3VPNs feature, you can
implement portal authentication across MPLS L3VPNs on MCE devices. For more information about MCE,
see MPLS Configuration Guide.
Figure 8 Network diagram for AAA across MPLS L3VPNs
VPN 1
Host
VPN 2
Host

Protocols and standards

The following protocols and standards are related to AAA, RADIUS, and HWTACACS:
RFC 2865, Remote Authentication Dial In User Service (RADIUS)
•
RFC 2866, RADIUS Accounting
•
"Configuring AAA methods for ISP
CE
NAS
PE
CE
domains."
Figure 8. Authentication packets of private users in
MPLS backbone
PE
P
14
VPN 3
RADIUS
server
CE
HWTACACS
server