Realms And Groups - Avaya P580 User Manual

Standard RADIUS

Realms and Groups

Overview
Document No. 650-100-700, Issue 1
A standard RADIUS configuration provides two types of access (also called
Service-Types): Administrative or Read-Only. This happens when a Group
name is not specified and no additional parameters are configured on the
RADIUS server for the user account. In the case of the Avaya switch, this
implies that a user is given Administrative or Read-Only access. The Avaya
switch includes a third type of access, Read-Write, which cannot create
other user accounts but can configure the switch. If you are using a Standard
RADIUS configuration, you will not be able to create user accounts that are
Read-Write.
Realms and Groups provide two separate functions. A Realm provides a
way of organizing user accounts on the RADIUS server. Groups provide a
way of organizing NADs a user can log into as well as delivering vendor-
specific configurable parameters.
For example, you might use a Realm called AvayaRealm to organize all of
the user accounts that can log into Avaya switches in a campus
environment. In this campus, there are two teams of network administrators,
one team for the North campus and one for the South campus. Each team
needs Read-Write access to the switches in their half of the campus and
Read-Only access to the switches in the other half of the campus.
You would then configure all of the North switches with a Group name of
NorthSwitches and the South switches with SouthSwitches.
For each user, you would create two user accounts in the AvayaRealm, one
with a Group name of NorthSwitches and one with SouthSwitches. Each
account would have the appropriate permissions for the two switch types.
When a user from the North team logs into a switch in the North campus,
the switch will send an Access Request message with @AvayaRealm
appended to the user name and a Group name of NorthSwitches. The
RADIUS server will send an Access Accept message indicating Read-Write
permission.
Similarly, when the same user logs in to a switch on the South campus, the
message will append @AvayaRealm and a Group name of SouthSwitches.
The RADIUS server will send an Access Accept message indicating Read-
Only permission.
Security
4-19