3Com Switch 4210 9-Port, Configuration Manual

Page: 250 / 567

248 C
HAPTER
21: AAA C
ONFIGURATION
Configuring separate AAA schemes
You can use the authentication , authorization , and accounting commands to
specify a scheme for each of the three AAA functions (authentication,
authorization and accounting) respectively. The following gives the
implementations of this separate way for the services supported by AAA.
1 For terminal users
■
Authentication: RADIUS, local, or none.
■
Authorization: none.
■
Accounting: RADIUS or none.
You can use an arbitrary combination of the above implementations for your AAA
scheme configuration.
2 For FTP users
Only authentication is supported for FTP users.
Authentication: RADIUS or local.
n
■
If a combined AAA scheme is configured as well as the separate
authentication, authorization and accounting schemes, the separate ones will
be adopted in precedence.
■
RADIUS scheme and local scheme do not support the separation of
authentication and authorization. Therefore, pay attention when you make
authentication and authorization configuration for a domain: When the
scheme radius-scheme or scheme local command is executed and the
authentication command is not executed, the authorization information
returned from the RADIUS or local scheme still takes effect even if the
authorization none command is executed.
Configuring Dynamic
VLAN Assignment
The dynamic VLAN assignment feature enables a switch to dynamically add the
switch ports of successfully authenticated users to different VLANs according to
the attributes assigned by the RADIUS server, so as to control the network
resources that different users can access.
Currently, the switch supports the following two types of assigned VLAN IDs:
integer and string.
Table 184 Configure separate AAA schemes
Operation Command Remarks
Enter system view system-view -
Create an ISP domain and
enter its view, or enter the
view of an existing ISP domain domain isp-name Required
Configure an authentication
scheme for the ISP domain authentication {
radius-scheme
radius-scheme-name [ local ] |
local | none }
Optional
By default, no separate
authentication scheme is
configured.
Configure an accounting
scheme for the ISP domain accounting { none |
radius-scheme
radius-scheme-name }
Optional
By default, no separate
accounting scheme is
configured.