Aaa Configuration Examples; Aaa For Ssh Users By An Hwtacacs Server - HP 6125XLG Configuration Manual

AAA configuration examples

Unless otherwise noted, devices in the configuration examples are operating in non-FIPS mode.

AAA for SSH users by an HWTACACS server

Network requirements
As shown in
authorization, and accounting.
Set the shared keys for secure HWTACACS communication to expert. Configure the switch to send
usernames without domain names to the HWTACACS server.
Configure the switch to assign the default user role network-operator to SSH users after they pass
authentication.
Figure 11 Network diagram
Configuration procedure
1. Configure the HWTACACS server:
# On the HWTACACS server, set the shared keys for secure communication with the switch to
expert, add an account for the SSH user, and specify the password. (Details not shown.)
2. Configure the switch:
# Assign IP addresses to the interfaces. (Details not shown.)
# Create an HWTACACS scheme.
<Switch> system-view
[Switch] hwtacacs scheme hwtac
# Specify the primary authentication server.
[Switch-hwtacacs-hwtac] primary authentication 10.1.1.1 49
# Specify the primary authorization server.
[Switch-hwtacacs-hwtac] primary authorization 10.1.1.1 49
# Specify the primary accounting server.
[Switch-hwtacacs-hwtac] primary accounting 10.1.1.1 49
# Set the shared keys for secure HWTACACS communication to expert in plain text.
[Switch-hwtacacs-hwtac] key authentication simple expert
[Switch-hwtacacs-hwtac] key authorization simple expert
Figure 1 1, configure the switch to use the HWTACACS server for SSH user authentication,
45