H3C SecPath F1800-A Operation Manual page 477

Operation Manual - Security Defence
H3C SecPath F1800-A Firewall
The authentication mode, authorization mode and RADIUS template adopted by the
user are determined by the authentication scheme configured in the domain. The user
can configure the authentication scheme and authorization scheme in AAA view, as
well as the authentication mode and authorization mode under these schemes.
AAA defaults its authentication scheme and authorization scheme as local
authentication scheme and local authorization scheme. The default schemes will be
adopted if the user does not configure new schemes after he has configured a new
domain.
In addition, you must configure first the RADIUS template and then adopt the template
in corresponding domain if you tend to adopt RADIUS authentication. For details,
refer to the said configuration examples.
Fault I: The user cannot pass the local authentication.
Troubleshooting:
Do as follows:
1) Check whether the corresponding domain is configured, and whether the
authentication scheme in the domain is local. The default configuration is
recommended if you tend to adopt local authentication.
2) Make sure that the correct password is set in the local-user command.
3) Ensure that the authorization server type is configured correctly.
Fault II: The user cannot pass the RADIUS authentication.
Troubleshooting:
Do as follows:
1) Check whether the RADIUS template in domain is correctly configured.
2) Make sure that the special attribute of Huawei-3Com is added into the attribute
dictionary on the RADIUS server.
3) Assure that the user name, password and service are correctly set on the
RADIUS server.
4) Use the ping command to text the network connectivity between the RADIUS
server and the router and check whether the RADIUS server IP address, port
number and key configured on the router are consistent with those of the
RADIUS server.
Fault III: Authentication is required even if no authentication is configured.
Troubleshooting:
Do as follows:
Because AAA adopts local authentication scheme by default, you must configure a
new authentication scheme if you do not tend to accept authentication. Then you can
6-125
Chapter 5 AAA