ZyXEL Communications IES4005M, User Manual

Page: 97 / 236

Chapter 11 Management
IES4005M User’s Guide
97
11.8 AAA Commands
Use these commands to configure authentication, authorization and accounting on the IES.
Authentication, Authorization, Accounting (AAA)
Authentication is the process of determining who a user is and validating access to the system. The
system can authenticate users who try to log in based on user accounts configured on the system
itself. The system can also use an external authentication server to authenticate a large number of
users.
Authorization is the process of determining what a user is allowed to do. Different user accounts
may have higher or lower privilege levels associated with them. For example, user A may have the
right to create new login accounts on the system but user B cannot. The system can authorize users
based on user accounts configured on the system itself or it can use an external server to authorize
a large number of users.
Accounting is the process of recording what a user is doing. The system can use an external server
to track when users log in, log out, execute commands and so on. Accounting can also record
system related actions such as boot up and shut down times of the system.
The external servers that perform authentication, authorization and accounting functions are known
as AAA servers. The system supports RADIUS (Remote Authentication Dial-In User Service) and
(Terminal Access Controller Access-Control System Plus) as external authentication and
accounting servers. The system supports as external authorization server only.
Local User Accounts
By storing user profiles locally on the IES, your IES is able to authenticate and authorize users
without interacting with a network authentication server. However, there is a limit on the number of
users you may authenticate in this way.
RADIUS and
RADIUS and are security protocols used to authenticate users by means of an external
server instead of (or in addition to) an internal device user database that is limited to the memory
capacity of the device. In essence, RADIUS and authentication both allow you to validate
an unlimited number of users from a central location.
The following table describes some key differences between RADIUS and .
Table 68
RADIUS vs.
RADIUS
Transport Protocol UDP (User Datagram Protocol) TCP (Transmission Control Protocol)
Encryption Encrypts the password sent for
authentication. All communication between the IES and
the server is encrypted.