H3C S5600 Series Operation Manual page 621

Operation Manual – AAA
H3C S5600 Series Ethernet Switches
Enter system view
Create an ISP domain
and enter its view, or enter
the view of an existing ISP
domain
Configure an
authentication scheme for
the ISP domain
Configure a HWTACACS
authentication scheme for
user level switching
Configure an
authorization scheme for
the ISP domain
Configure an accounting
scheme for the ISP
domain
Note:
RADIUS scheme and local scheme do not support the separation of authentication
and authorization. Therefore, pay attention when you make authentication and
authorization configuration for a domain: When the scheme radius-scheme or
scheme local command is executed and the authentication command is not
executed, the authorization information returned from the RADIUS or local scheme
still takes effect even if the authorization none command is executed.
The S5600 series switches adopt hierarchical protection for command lines so as to
inhibit users at lower levels from using higher level commands to configure the
switches. For details about configuring a HWTACACS authentication scheme for
low-to-high user level switching, refer to Switching User Level in the Command Line
Interface Operation.
To do...
system-view
domain isp-name
authentication
{ radius-scheme
radius-scheme-name
[ local ] |
hwtacacs-scheme
hwtacacs-scheme-name
[ local ] | local | none }
authentication super
hwtacacs-scheme
hwtacacs-scheme-name
authorization { none |
hwtacacs-scheme
hwtacacs-scheme-name }
accounting { none |
radius-scheme
radius-scheme-name |
hwtacacs-scheme
hwtacacs-scheme-name }
Use the command...
2-6
Chapter 2 AAA Configuration
Remarks
—
Required
Optional
By default, no separate
authentication scheme is
configured.
Optional
By default, no
HWTACACS
authentication scheme is
configured.
Optional
By default, no separate
authorization scheme is
configured.
Optional
By default, no separate
accounting scheme is
configured.