Operation Manual - Security
Quidway S3000 Series Ethernet Switches
Chapter 2 AAA and RADIUS Protocol Configuration
2-3
Internet
S3000 series
PC user1
PC user2
PC user3
PC user4
S3000 series
S2000-SI series
S2000-SI series
ISP1
ISP2
Internet
Authentication
Server
Accounting
Server
Authentication
Server
Accounting
Server1
Accounting
Server2
Internet
Internet
PC user1
PC user2
PC user3
PC user4
ISP1
ISP2
Internet
Authentication
Server
Accounting
Server
Authentication
Server
Accounting
Server1
Accounting
Server2
Figure 2-1
Networking when S3000 Series Ethernet switches applying RADIUS authentication
2.2 Configure AAA
AAA configuration includes:
z
Create/Delete ISP Domain
z
Configure Relevant Attributes of ISP Domain
z
Create a local user
z
Set attributes of local user
z
Disconnect a user by force
Among the above configuration tasks, creating ISP domain is compulsory, otherwise
the supplicant attributes cannot be distinguished. The other tasks are optional. You can
configure them at requirements.
2.2.1 Create/Delete ISP Domain
What is Internet Service Provider (ISP) domain? To make it simple, ISP domain is a
group of users belonging to the same ISP. Generally, for a username in the
userid@isp-name format, taking [email protected] as an example, the
isp-name (i.e. huawei163.net) following the @ is the ISP domain name. When Quidway
Series Ethernet Switches control user access, as for an ISP user whose username is in
userid@isp-name format, the system will take userid part as username for identification
and take isp-name part as domain name.
The purpose of introducing ISP domain settings is to support the multi-ISP application
environment. In such environment, one access device might access users of different
ISP. Because the attributes of ISP users, such as username and password formats, etc,
may be different, it is necessary to differentiate them through setting ISP domain. In
