3Com WX3000 Series Operation Manual page 263

this way, you cannot specify different schemes for authentication, authorization and accounting
respectively.
Follow these steps to configure a combined AAA scheme:
To do...
Enter system view
Create an ISP domain and
enter its view, or enter the view
of an existing ISP domain
Configure an AAA scheme for
the ISP domain
You can execute the scheme radius-scheme radius-scheme-name command to adopt an already
configured RADIUS scheme to implement all the three AAA functions. If you adopt the local
scheme, only the authentication and authorization functions are implemented, the accounting
function cannot be implemented.
If you execute the scheme radius-scheme radius-scheme-name local command, the local
scheme is used as the secondary scheme in case no RADIUS server is available. That is, if the
communication between the device and a RADIUS server is normal, no local authentication is
performed; otherwise, local authentication is performed.
If you execute the scheme hwtacacs-scheme hwtacacs-scheme-name local command, the local
scheme is used as the secondary scheme in case no TACACS server is available. That is, if the
communication between the device and a TACACS server is normal, no local authentication is
performed; otherwise, local authentication is performed.
If you execute the scheme local or scheme none command to adopt local or none as the primary
scheme, the local authentication is performed or no authentication is performed. In this case you
cannot specify any RADIUS scheme or HWTACACS scheme at the same time.
If you execute the scheme none command, the FTP users in the domain will not pass the
authentication. So, to allow users to use the FTP service, you should not configure the none
scheme.
Configuring separate AAA schemes
You can use the authentication, authorization, and accounting commands to specify a scheme for
each of the three AAA functions (authentication, authorization and accounting) respectively. The
following gives the implementations of this separate way for the services supported by AAA.
1) For terminal users
Authentication: RADIUS, local, HWTACACS or none.
Authorization: none or HWTACACS.
Accounting: RADIUS, HWTACACS or none.
Use the command...
system-view
domain isp-name
scheme { local | none |
radius-scheme
radius-scheme-name [ local ] |
hwtacacs-scheme
hwtacacs-scheme-name
[ local ] }
2-4
Remarks
—
Required
Required
By default, an ISP domain uses
the local AAA scheme.