3Com S7906E Configuration Manual page 1818

1 AAA Configuration ····································································································································1-1
Introduction to AAA ·································································································································1-1
Introduction to RADIUS···························································································································1-2
Client/Server Model ·························································································································1-3
Security and Authentication Mechanisms ·······················································································1-3
Basic Message Exchange Process of RADIUS ··············································································1-3
RADIUS Packet Format···················································································································1-4
Extended RADIUS Attributes ··········································································································1-7
Introduction to HWTACACS····················································································································1-8
Differences Between HWTACACS and RADIUS············································································1-8
Basic Message Exchange Process of HWTACACS ·······································································1-9
Domain-Based User Management········································································································1-10
Protocols and Standards·······················································································································1-11
AAA Configuration Task List ·················································································································1-11
AAA Configuration Task List ·········································································································1-12
RADIUS Configuration Task List ···································································································1-13
HWTACACS Configuration Task List ····························································································1-13
Configuring AAA····································································································································1-14
Configuration Prerequisites ···········································································································1-14
Creating an ISP Domain················································································································1-14
Configuring ISP Domain Attributes································································································1-15
Configuring AAA Authentication Methods for an ISP Domain·······················································1-15
Configuring AAA Authorization Methods for an ISP Domain ························································1-17
Configuring AAA Accounting Methods for an ISP Domain····························································1-19
Configuring Local User Attributes··································································································1-21
Configuring User Group Attributes ································································································1-22
Tearing down User Connections Forcibly ·····················································································1-23
Configuring a NAS ID-VLAN Binding ····························································································1-23
Displaying and Maintaining AAA ···································································································1-24
Configuring RADIUS ·····························································································································1-24
Creating a RADIUS Scheme ·········································································································1-25
Specifying the RADIUS Authentication/Authorization Servers······················································1-25
Specifying the RADIUS Accounting Servers and Relevant Parameters·······································1-26
Setting the Shared Key for RADIUS Packets················································································1-27
Setting the Upper Limit of RADIUS Request Retransmission Attempts ·······································1-28
Setting the Supported RADIUS Server Type ················································································1-28
Setting the Status of RADIUS Servers ··························································································1-29
Configuring Attributes Related to Data to Be Sent to the RADIUS Server ···································1-30
Enabling the RADIUS Trap Function·····························································································1-30
Specifying the Source IP Address for RADIUS Packets to Be Sent ·············································1-31
Setting Timers Regarding RADIUS Servers··················································································1-31
Specifying a Security Policy Server·······························································································1-32
Enabling the Listening Port of the RADIUS Client ········································································1-33
Table of Contents
i