1
Configuring AAA
AAA provides a uniform framework for implementing network access management. It provides the
following security functions:
•
Authentication
—Identifies users and determines whether a user is valid.
•
Authorization
—Grants different users different rights and controls their access to resources and
services. For example, a user who has successfully logged in to the router can be granted read and
print permissions to the files on the router.
•
Accounting
—Records all network service usage information of users, including the service type,
start time, and traffic. The accounting function not only provides the information required for
charging but also allows for network security surveillance.
AAA usually uses a client/server model. The client runs on the NAS, and the server maintains user
information centrally. In an AAA network, a NAS is a server for users but a client for the AAA servers,
as shown in
.
Figure 1
Network diagram for AAA
When a user tries to log in to the NAS, use network resources, or access other networks, the NAS
authenticates the user. The NAS can transparently pass the user's authentication, authorization, and
accounting information to the servers. The RADIUS and HWTACACS protocols define how a NAS and a
remote server exchange user information between them.
In the network shown in
, there is a RADIUS server and an HWTACACS server. Choose different
servers for different security functions. For example, use the HWTACACS server for authentication and
authorization, and use the RADIUS server for accounting.
Use AAA to provide only one or two security functions, if desired. For example, if your company only
wants employees to be authenticated before they access specific resources, you only have to configure
an authentication server. If network usage information is expected to be recorded, you also have to
configure an accounting server.
AAA can be implemented through multiple protocols. The router supports using RADIUS and
HWTACACS. RADIUS is often used in practice.
