huawei(config)#
aaa
huawei(config-aaa)#
authentication-scheme login-auth
huawei(config-aaa-authen-login-auth)#
authentication-mode hwtacacs
huawei(config-aaa-authen-login-auth)#
quit
Step 2
Configure the HWTACACS protocol.
Create HWTACACS server template named
ma56t-login
with HWTACACS server
10.10.66.66 as the primary authentication server, and HWTACACS server 10.10.66.67 as the
secondary authentication server.
huawei(config)#
hwtacacs-server template ma56t-login
Create a new HWTACACS-server template
huawei(config-hwtacacs-ma56t-login)#
hwtacacs-server authentication 10.10.66.66
1812
huawei(config-hwtacacs-ma56t-login)#
hwtacacs-server authentication 10.10.66.67
1812 secondary
huawei(config-hwtacacs-ma56t-login)#
quit
Step 3
Create a domain named
isp1
.
NOTE
l
A domain is a group of users of the same type.
l
In the user name format userid@domain-name (for example, [email protected]), "userid"
indicates the user name for authentication and "domain-name" followed by "@" indicates the domain name.
l
The domain name for user login cannot exceed 15 characters, and the other domain names cannot exceed
20 characters.
huawei(config)#
aaa
huawei(config-aaa)#
domain isp1
Info: Create a new domain
Step 4
Use the authentication scheme
login-auth
.
You can use an authentication scheme in a domain only after the authentication scheme is
created.
huawei(config-aaa-domain-isp1)#
authentication-scheme login-auth
Step 5
Bind the HWTACACS server template
ma56t-login
to the user.
You can use an HWTACACS server template in a domain only after the HWTACACS server
template is created.
huawei(config-aaa-domain-isp1)#
hwtacacs-server ma56t-login
----End
Result
l
When the HWTACACS server is reachable, the management user can log in to the
MA5600T/MA5603T/MA5608T through SSH. After entering the user name and password
specified on the HWTACACS server, the management user can successfully log in to the
MA5600T/MA5603T/MA5608T.
l
When the HWTACACS server is unreachable, the management user cannot log in to the
MA5600T/MA5603T/MA5608T through SSH by entering the user name and password
specified on the HWTACACS server.
Configuration File
huawei(config)#
aaa
huawei(config-aaa)#
authentication-scheme login-auth
SmartAX MA5600T/MA5603T/MA5608T Multi-service
Access Module
Commissioning and Configuration Guide
2 Basic Configurations
Issue 01 (2014-04-30)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
249