3Com Switch 7754, Configuration Manual, Page: 520 / 940

520 C
HAPTER
49: AAA & RADIUS & HWTACACS C
ONFIGURATION
n
3Com’s CAMS Server is a service management system used to manage networks
and secure networks and user information. Cooperating with other network
devices (such as switches) in a network, the CAMS Server implements the AAA
(authentication, authorization and accounting) services and rights management.
Configuring an AAA
Scheme for an ISP
Domain
You can configure an AAA scheme in one of the following two ways:
Configuring a bound AAA scheme
You can use the scheme command to specify an AAA scheme. If you specify a
RADIUS or HWTACACS scheme, the authentication, authorization and accounting
will be uniformly implemented by the RADIUS server or TACACS server specified in
the RADIUS or HWTACACS scheme. In this way, you cannot specify different
schemes for authentication, authorization and accounting respectively.
c
CAUTION:
■
You can execute the scheme command with the radius-scheme-name
argument to adopt an already configured RADIUS scheme to implement all the
three AAA functions. If you adopt the local scheme, only the authentication
and authorization functions are implemented, the accounting function cannot
be implemented.
■
If you execute the scheme radius-scheme radius-scheme-name local
command, the local scheme becomes the secondary scheme in case the
RADIUS server does not response normally. That is, if the communication
between the switch and the RADIUS server is normal, no local authentication is
performed; otherwise, local authentication is performed.
■
If you execute the scheme hwtacacs-scheme radius-scheme-name local
command, the local scheme becomes the secondary scheme in case the
TACACS server does not respond normally. That is, if the communication
between the switch and the TACACS server is normal, no local authentication is
performed; otherwise, local authentication is performed.
■
If you adopt local or none as the primary scheme, the local authentication is
performed or no authentication is performed. In this case, you cannot perform
RADIUS authentication at the same time.
Table 401 Configure an AAA scheme for an ISP domain
Operation Command Description
Enter system view system-view -
Create an ISP domain or
enter the view of an
existing ISP domain domain isp-name Required
Configure an AAA
scheme for the ISP
domain scheme { local | none | radius-scheme
radius-scheme-name [ local ] |
hwtacacs-scheme
hwtacacs-scheme-name [ local ] }
Required
By default, the ISP
domain uses the
local
AAA scheme.
Configure an RADIUS
scheme for the ISP
domain radius-scheme radius-scheme-name Optional
This function can also
be implemented by
using the
scheme
command to specify
the RADIUS scheme
to be used.