Zte ZXR10 8900E series, Product Description

Page: 71 / 132

ZXR10 8900E series Core Switch Product Description
ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. 61

L2 ACL: match source MAC address, destination MAC address, source VLAN ID,
L2 Ethernet protocol type and 802.1p precedence.

Hybrid IP address: match source MAC address, destination MAC address, source
VLAN ID, source IP address, destination IP address, TCP source port number, TCP
destination port number, UDP source port number and UDP destination port
number. The perfect fields match three types mentioned above.

Basic IPv6 ACL: only match IPv6 source IP address.

Extended IPv6 ACL: match IPv6 source and destination addresses.
3.8.2 Device Authentication
3.8.2.1 AAA Authentication
ZXR10 8900E supports complete AAA (Authentication, Authorization and Accounting )
mechanism. So it not only can be used to arrange login user authentiation and
authorization together with hierarchical protection mechanism of command line, but also
can verify user’s validity in network management. based upon AAA mechanism, ZXR10
8900E can effectively prevent illegal users from logging in the system.
For different user access authentication policies, the device provides complete AAA
service. As per different access authentication requirements, user can configure different
access authentication policies to arrange different authentication and authorization
services.
AAA supports three types of user authentication:

Local account authentication

RADIUS (Remote Authentication Dial-In User Service) authentication

(Terminal Access Controller Access Control System) authentication

AAA supports four types of authorization mode:

Direct authorization: for very trustable user, direct authorization without requiring
account number is implemented.

Local account authorization: give authority as per user’s local account.

authorization: consists of authentication and authorization.
server gives user authorities.

Authorization when RADIUS authentication is successful: the authentication and
authorization of RADIUS can not be apart.