Example
User1 in the isp domain adopts the HWTACACS protocol for authentication, authorization, and
accounting. The accounting interval is 10 minutes, the authentication password is a123456,
HWTACACS server 129.7.66.66 functions as the primary authentication, authorization, and
accounting server, and HWTACACS server 129.7.66.67 functions as the standby authentication,
authorization, and accounting server. On the HWTACACS server, the parameters adopt the
default values. To perform the preceding configuration, do as follows:
huawei(config)#
aaa
huawei(config-aaa)#
authentication-scheme newscheme
huawei(config-aaa-authen-newscheme)#
authentication-mode hwtacacs
huawei(config-aaa-authen-newscheme)#
quit
huawei(config-aaa)#
authorization-scheme newscheme
huawei(config-aaa-author-newscheme)#
authorization-mode hwtacacs
huawei(config-aaa-author-newscheme)#
quit
huawei(config-aaa)#
accounting-scheme newscheme
huawei(config-aaa-accounting-newscheme)#
accounting-mode hwtacacs
huawei(config-aaa-accounting-newscheme)#
accounting interim interval 10
huawei(config-aaa-accounting-newscheme)#
quit
huawei(config-aaa)#
quit
huawei(config)#
hwtacacs-server template hwtest
huawei(config-hwtacacs-hwtest)#
hwtacacs-server authentication 129.7.66.66
huawei(config-hwtacacs-hwtest)#
hwtacacs-server authentication 129.7.66.67
secondary
huawei(config-hwtacacs-hwtest)#
hwtacacs-server authorization 129.7.66.66
huawei(config-hwtacacs-hwtest)#
hwtacacs-server authorization 129.7.66.67 secondary
huawei(config-hwtacacs-hwtest)#
hwtacacs-server accounting 129.7.66.66
huawei(config-hwtacacs-hwtest)#
hwtacacs-server accounting 129.7.66.67 secondary
huawei(config-hwtacacs-hwtest)#
quit
huawei(config)#
aaa
huawei(config-aaa)#
domain isp
huawei(config-aaa-domain-isp)#
authentication-scheme newscheme
huawei(config-aaa-domain-isp)#
authorization-scheme newscheme
huawei(config-aaa-domain-isp)#
accounting-scheme newscheme
huawei(config-aaa-domain-isp)#
hwtacacs-server hwtest
huawei(config-aaa-domain-isp)#
quit
3.12.4 Configuration Example of the Authentication Based on the
RADIUS Protocol (Device Management Users)
The MA5616 allows the management user of the device to log in to the system by preferring the
RADIUS authentication mode. Local authentication can be used only when the RADIUS server
is unreachable. This feature provides ISPs with flexible authentication strategies.
Prerequisites
l
The route from the MA5616 to the RADIUS server must be configured.
l
The management user information (user name@domain and password) must be configured
on the RADIUS server.
Service Requirements
l
Prefer the RADIUS server to authenticate management user of domain
isp1
.
l
Local authentication can be used when the RADIUS server is unreachable.
l
The user logs in to the server carrying the domain name.
l
The RADIUS server with the IP address 129.7.66.66 functions as the primary server for
authentication.
SmartAX MA5616 Multi-service Access Module
Configuration Guide
3 Basic Configuration
Issue 04 (2011-10-30)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
104