Operation Manual – AAA-RADIUS-HWTACACS
H3C S3610&S5510 Series Ethernet Switches
Chapter 1 AAA/RADIUS/HWTACACS
Configuration
1-2
z
Local authentication: User information (including username, password, and
attributes) is configured on the device. Local authentication features high speed
and low cost, but the amount of information that can be stored is limited by the
hardware.
z
Remote authentication: Both RADIUS and HWTACACS protocols are supported.
In this approach, the device acts as the client to communicate with the RADIUS or
HWTACACS server. With respect to RADIUS, you can use the standard RADIUS
protocol or extended RADIUS protocol to complete authentication in collaboration
with systems like iTELLIN/CAMS.
II. Authorization
AAA supports the following authorization methods:
z
Direct authorization: All users are trusted and authorized. A user gets the default
rights of the system.
z
Local authorization: Users are authorized according to the attributes configured for
them on the device.
z
RADIUS authorization: RADIUS authorization is bound with RADIUS
authentication. RADIUS authorization can work only after RADIUS authentication
is successful. The authorization information is carried in the RADIUS
authentication response.
z
HWTACACS authorization: Users are authorized using a HWTACACS server.
III. Accounting
AAA supports the following accounting methods:
z
None accounting: The system does not keep accounts on the users.
z
Local accounting: Local accounting is for controlling the number of local user
connections and collecting statistics on number of users; it does not provide
statistics on the charges of users. Note that the controlling of the local user
connections does not affect the local authentication and authorization.
z
Remote accounting: Accounting is implemented by a RADIUS server or
HWTACACS server remotely.
AAA usually uses a client/server model, where the client runs on the device that
controls user access and the server stores user information. The framework of AAA
thus allows for excellent scalability and centralized user information management.
Being a management framework, AAA can be implemented through multiple protocols.
Currently, AAA is implemented based on RADIUS or HWTACACS.
1.1.2 Introduction to ISP Domain
An Internet service provider (ISP) domain is a group of users that belong to the same
ISP. For a username in the
userid
@
isp-name
format, the
isp-name
following the @ sign
