Configuring AAA ························································································································································· 1

AAA overview ··································································································································································· 1

RADIUS ······································································································································································ 2

HWTACACS ····························································································································································· 7

Domain-based user management ··························································································································· 9

RADIUS server feature of the switch ···················································································································· 10

AAA for MPLS L3VPNs ········································································································································· 11

Protocols and standards ······································································································································· 11

RADIUS attributes ·················································································································································· 12

FIPS compliance ····························································································································································· 15

AAA configuration considerations and task list ·········································································································· 15

Configuring AAA schemes ············································································································································ 16

Configuring local users ········································································································································· 16

Configuring RADIUS schemes ······························································································································ 21

Configuring HWTACACS schemes ····················································································································· 34

Configuring AAA methods for ISP domains ················································································································ 41

Configuration prerequisites ·································································································································· 41

Creating an ISP domain ······································································································································· 41

Configuring ISP domain attributes ······················································································································· 41

Configuring AAA authentication methods for an ISP domain ·········································································· 43

Configuring AAA authorization methods for an ISP domain ··········································································· 44

Configuring AAA accounting methods for an ISP domain ··············································································· 46

Tearing down user connections ···································································································································· 47

Configuring a NAS ID-VLAN binding ·························································································································· 47

Specifying the device ID used in stateful failover mode ···························································································· 48

Configuring a switch as a RADIUS server ··················································································································· 48

RADIUS server functions configuration task list ·································································································· 48

Configuring a RADIUS user ·································································································································· 48

Specifying a RADIUS client ·································································································································· 49

Displaying and maintaining AAA ································································································································ 50

AAA configuration examples ········································································································································ 50

AAA for Telnet users by an HWTACACS server ······························································································· 50

AAA for Telnet users by separate servers ··········································································································· 51

Authentication/authorization for SSH/Telnet users by a RADIUS server ························································ 53

Level switching authentication for Telnet users by an HWTACACS server ····················································· 56

RADIUS authentication and authorization for Telnet users by a switch ··························································· 60

Troubleshooting AAA ···················································································································································· 62

Troubleshooting RADIUS ······································································································································· 62

Troubleshooting HWTACACS ······························································································································ 63

802.1X overview ······················································································································································· 64

802.1X architecture ······················································································································································· 64

Controlled/uncontrolled port and port authorization status ······················································································ 64

802.1X-related protocols ·············································································································································· 65

Packet formats ························································································································································ 65

EAP over RADIUS ·················································································································································· 67

Initiating 802.1X authentication ··································································································································· 67

802.1X client as the initiator································································································································ 67

Access device as the initiator ······························································································································· 67