33
•
With the
radius-scheme
radius-scheme-name
local
or
hwtacacs-scheme
hwtacacs-scheme-name
[
local
|
none
]
keyword and argument combination configured, local authorization (
local
) or no
authentication (
none
) is the backup when the remote server is not available.
•
If the primary authorization method is
local
or
none
, the system performs local authorization or does
not perform any authorization. The system never uses the RADIUS or HWTACACS authorization scheme.
•
The authorization information of the RADIUS server is sent to the RADIUS client with the authentication
response message. You cannot specify a separate RADIUS authorization server. If you use RADIUS for
authorization and authentication, you must use the same scheme setting for authorization and
authentication. If not, the system prompts you with an error message.
Configuring AAA accounting methods for an ISP domain
In AAA, accounting is a separate process at the same level as authentication and authorization.
This process sends accounting start/update/end requests to the specified accounting server.
Accounting is optional.
AAA supports the following accounting methods:
•
No accounting (none): The system does not perform accounting for the users.
•
Local accounting (local): Local accounting is implemented on the access device, collects
statistics on the number of users, and controls the number of local user connections. It does
not provide statistics for user charge.
•
Remote accounting (scheme): The access device works with a RADIUS server or HWTACACS
server for accounting of users. You can configure local accounting as the backup in case the
remote server is not available.
By default, an ISP domain uses the local accounting method.
Before configuring accounting methods, complete these three tasks:
1.
For RADIUS or HWTACACS accounting, configure the RADIUS or HWTACACS scheme to
be referenced first. The local and none authentication methods do not require a scheme.
2.
Determine the access mode or service type to be configured. With AAA, you can configure
an accounting method specifically for each access mode and service type, limiting the
accounting protocols that can be used for access.
3.
Determine whether to configure an accounting method for all access modes or service types.
Follow these steps to configure AAA accounting methods for an ISP domain:
To do…
Use the command…
Remarks
1.
Enter system view
system-view
—
2.
Enter ISP domain view
domain
Isp-name
—
3.
Enable the accounting optional
feature
accounting optional
Optional
Disabled by default
4.
Specify the default accounting
method for all types of users
accounting default
{
hwtacacs-scheme
hwtacacs-
scheme-name
[
local
] |
local
|
none
|
radius-scheme
radius-
scheme-name
[
local
] }
Optional
local
by default
