10
For a user who has logged in to the device, AAA provides the following services to enhance device
security:
Command authorization—Enables the NAS to defer to the authorization server to determine whether
a command entered by a login user is permitted for the user, ensuring that login users execute only
commands they are authorized to execute. For more information about command authorization, see
the
Fundamentals Configuration Guide.
Command accounting—Allows the accounting server to record all commands executed on the
device or all authorized commands successfully executed. For more information about command
accounting, see the
Fundamentals Configuration Guide.
Level switching authentication—Allows the authentication server to authenticate users performing
privilege level switching. As long as passing level switching authentication, users can switch their
user privilege levels, without logging out and disconnecting current connections. For more
information about user privilege level switching, see the
Fundamentals Configuration Guide.
You can configure different authentication, authorization, and accounting methods for different users in a
domain. See ―
Configuring AAA methods for ISP domains
.―
RADIUS server feature of the device
Generally, the RADIUS server runs on a computer or workstation, and the RADIUS client runs on a NAS
device. A network device that supports the RADIUS server feature can also serve as the RADIUS server,
working with RADIUS clients to implement user authentication, authorization, and accounting. As shown
in
, the RADIUS server and client can reside on the same device or different devices.
Using a network device as the RADIUS server simplifies networking and reduces deployment costs. This
implementation is usually deployed on networks by using the clustering feature. In such a scenario,
configure the RADIUS server feature on a management device at the distribution layer, so that the device
functions as a RADIUS server to cooperate with cluster member switches at the access layer to provide
user authentication and authorization services.
Figure 8
Devices functioning as a RADIUS server
NAS
RADIUS server
RADIUS server
NAS/
IP network
IP network
A network device serving as the RADIUS server can provide the following functions:
User information management—Supports creating, modifying, and deleting user information,
including the username, password, authority, lifetime, and user description.
RADIUS client information management—Supports creating, and deleting RADIUS clients, which are
identified by IP addresses and configured with attributes such as a shared key. After being
configured with a managed client range, the RADIUS server processes only the RADIUS packets
