3Com 4210 PWR Configuration Manual page 250

248 C 21: AAA C
HAPTER
n
Configuring Dynamic
VLAN Assignment
ONFIGURATION
Configuring separate AAA schemes
You can use the authentication, authorization, and accounting commands to
specify a scheme for each of the three AAA functions (authentication,
authorization and accounting) respectively. The following gives the
implementations of this separate way for the services supported by AAA.
1 For terminal users
Authentication: RADIUS, local, or none.
■
Authorization: none.
■
Accounting: RADIUS or none.
■
You can use an arbitrary combination of the above implementations for your AAA
scheme configuration.
2 For FTP users
Only authentication is supported for FTP users.
Authentication: RADIUS or local.
Table 184 Configure separate AAA schemes
Operation
Enter system view
Create an ISP domain and
enter its view, or enter the
view of an existing ISP domain
Configure an authentication
scheme for the ISP domain
Configure an accounting
scheme for the ISP domain
If a combined AAA scheme is configured as well as the separate
■
authentication, authorization and accounting schemes, the separate ones will
be adopted in precedence.
RADIUS scheme and local scheme do not support the separation of
■
authentication and authorization. Therefore, pay attention when you make
authentication and authorization configuration for a domain: When the
scheme radius-scheme or scheme local command is executed and the
authentication command is not executed, the authorization information
returned from the RADIUS or local scheme still takes effect even if the
authorization none command is executed.
The dynamic VLAN assignment feature enables a switch to dynamically add the
switch ports of successfully authenticated users to different VLANs according to
the attributes assigned by the RADIUS server, so as to control the network
resources that different users can access.
Currently, the switch supports the following two types of assigned VLAN IDs:
integer and string.
Command
system-view
domain isp-name
authentication {
radius-scheme
radius-scheme-name [ local ] |
local | none }
accounting { none |
radius-scheme
radius-scheme-name }
Remarks
-
Required
Optional
By default, no separate
authentication scheme is
configured.
Optional
By default, no separate
accounting scheme is
configured.