43
To do…
Command…
Remarks
7.
Specify the
authentication method
for portal users.
authentication portal
{
local
|
none
|
radius-scheme
radius-scheme-name
[
local
]
}
Optional.
The default authentication
method is used by default.
8.
Specify the
authentication method
for PPP users.
authentication ppp
{
hwtacacs-scheme
hwtacacs-scheme-name
[
local
] |
local
|
none
|
radius-scheme
radius-scheme-name
[
local
] }
Optional.
The default authentication
method is used by default.
9.
Specify the
authentication method
for SSL VPN users.
authentication ssl-vpn radius-scheme
radius-
scheme-name
Optional.
The default authentication
method is used by default.
10.
Specify the
authentication method
for privilege level
switching.
authentication super
{
hwtacacs-scheme
hwtacacs-scheme-name
|
radius-scheme
radius-scheme-name
}
Optional.
The default authentication
method is used by default.
NOTE:
•
The authentication method specified with
authentication default
is for all types of users and has a
lower priority than that for a specific access type.
•
With an authentication method that references a RADIUS scheme, AAA accepts only the
authentication result from the RADIUS server. The Access-Accept message from the RADIUS server
does include the authorization information, but the authentication process ignores the information.
•
If you specify the
radius-scheme
radius-scheme-name
local
or
hwtacacs-scheme
hwtacacs-scheme-
name
local
keyword and argument combination when configuring an authentication method, local
authentication is the backup method. It is used only when the remote server is not available.
•
If you specify only the
local
or
none
keyword in an authentication method configuration command,
the router has no backup authentication method. It performs only local authentication or does not
perform any authentication.
•
If the method for level switching authentication references an HWTACACS scheme, the router uses the
login username of a user for level switching authentication of the user by default. If the method for
level switching authentication references a RADIUS scheme, the system uses the username configured
for the corresponding privilege level on the RADIUS server for level switching authentication rather
than the login username. A username configured on the RADIUS server is in the format of
$enab
level
$
, where
level specifies the privilege level to which the user wants to switch. For example, if
user
user1
of domain
aaa
wants to switch the privilege level to 3, the system uses
$enab3@aaa$
for
authentication when the domain name is required and uses
$enab3$
for authentication when the
domain name is not required.
Configuring AAA authorization methods for an ISP domain
In AAA, authorization is a separate process at the same level as authentication and accounting. Its
responsibility is to send authorization requests to the specified authorization servers and to send
authorization information to users after successful authorization. Authorization method configuration is
optional in AAA configuration.
