Operation Manual – AAA
H3C S5100-SI/EI Series Ethernet Switches
Chapter 2 AAA Configuration
2-34
I. Network requirements
In the network environment shown in
Figure 2-1
, you are required to configure the
switch so that the Telnet users logging into the switch are authenticated by the RADIUS
server.
z
A RADIUS authentication server with IP address 10.110.91.164 is connected to
the switch.
z
On the switch, set the shared key it uses to exchange messages with the
authentication RADIUS server to
aabbcc
.
z
A CAMS server is used as the RADIUS server. You can select
extended
as the
server-type in a RADIUS scheme.
z
On the RADIUS server, set the shared key it uses to exchange messages with the
switch to
aabbcc
, set the authentication port number, and add Telnet usernames
and login passwords.
The Telnet usernames added to the RADIUS server must be in the format of
userid
@
isp-name
if you have configured the switch to include domain names in the
usernames to be sent to the RADIUS server in the RADIUS scheme.
II. Network diagram
Internet
Telnet user
RADIUS server
10.110.91.164/16
Figure 2-1
Remote RADIUS authentication of Telnet users
III. Configuration procedure
# Enter system view.
<Sysname> system-view
# Adopt AAA authentication for Telnet users.
[Sysname] user-interface vty 0 4
[Sysname-ui-vty0-4] authentication-mode scheme
[Sysname-ui-vty0-4] quit
# Configure an ISP domain.
[Sysname] domain cams
[Sysname-isp-cams] access-limit enable 10
