275
DWS-1008 User’s Manual
D-Link Systems, Inc.
Configuring AAA for Network Users
AAA for network users controls and monitors their use of the network:
•
Classification for customized access.
As with administrative and console users,
you can classify network users through username globbing. Based on the structured
username, different AAA treatments can be given to different classes of user. For
example, users in the human resources department can be authenticated differently
from users in the sales department.
•
Authentication for full or limited access.
IEEE 802.1X network users are
authenticated when they identify themselves with a credential. Authentication can
be passed through to RADIUS, performed locally on the switch, or only partially
“offloaded” to the switch. Network users without 802.1X support can be authenticated
by the MAC addresses of their devices. If neither 802.1X nor MAC authentication
apply to the user, they can still be authenticated by a
fallthru
authentication type,
either WebAAA or last-resort authentication. The default fallthru type is None, which
denies access to users who do not match an 802.1X or MAC authentication rule.
•
Authorization for access control.
Authorization
provides access control by
means of such mechanisms as per-user security access control lists (ACLs), VLAN
membership, and timeout enforcement. Because authorization is always performed
on network access users so they can use a particular VLAN, the utomatically uses
the same AAA method (RADIUS server group or local database) for authorization
that you define for a user’s authentication.
•
Local authorization control.
You can override any AAA assignment of VLAN or
security ACL for individual network users on a particular switch by configuring the
location policy on the switch.
•
Accounting for tracking users and resources.
Accounting collects and sends
information used for billing, auditing, and reporting - for example, user identities,
connection start and stop times, the number of packets received and sent, and the
number of bytes transferred. You can track sessions through accounting information
stored locally or on a remote RADIUS server.
AAA Tools for Network Users
Authentication verifies network user identity and is required before a network user is granted
access to the network. A switch authenticates user identity by username-password matching,
digital signatures and certificates, or other methods (for example, by MAC address).
You must decide whether to authenticate network users locally on the switch, remotely via
one or more external RADIUS server groups, or both locally and remotely.
