Introduction To Aaa And User Management; Aaa And User Management Features Supported By The S9300 - Huawei Quidway S9300 Configuration Manual

1 AAA and User Management Configuration

1.1 Introduction to AAA and User Management

This section describes the knowledge of AAA and user management.
AAA
AAA provides the following types of services:
l
l
l
AAA adopts the client/server model, which features good extensibility and facilitates
concentrated management over user information.
Domain-based User Management
User authentication, authorization, and accounting are performed in the domain view. Users can
be managed based on the domain. You can configure authorization, create authentication and
accounting schemes, and create RADIUS or HWTACACS templates in the domain.
Local User Management
To perform local user management, you need to set up the local user database, maintain user
information, and manage users on the local S9300.
1.2 AAA and User Management Features Supported by the
S9300
This section describes the AAA and user management features supported by the S9300.
AAA
The S9300 provides authentication schemes in the following modes:
l
l
l
The S9300 provides authorization schemes in the following modes:
1-2
Authentication: determines the user who can access the network.
Authorization: authorizes the user to use certain services.
Accounting: records network resource usage of the user.
NOTE
Currently, the S9300 does not support user accounting.
Non-authentication: completely trusts users and does not check their validity. This mode
is seldom used.
Local authentication: configures user information including the user name, password, and
attributes of the local user on the S9300. In local authentication mode, the processing speed
is fast, but the capacity of information storage is restricted by the hardware.
Remote authentication: configures user information including the user name, password,
and attributes of the local user on an authentication server. The S9300 functions as the client
to communicate with the authentication server. Thus, the user is remotely authenticated
through the RADIUS or HWTACACS protocol.
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
Quidway S9300 Terabit Routing Switch
Configuration Guide - Security
Issue 01 (2009-07-28)