HP A5830 Series, Руководство по настройке

Страница: 9 / 280

1
Configuring AAA
AAA provides a uniform framework for implementing network access management. It can provide the
following security functions:
•
Authentication —Identifies users and determines whether a user is valid.
•
Authorization —Grants different users different rights and controls their access to resources and
services. For example, a user who has successfully logged in to the switch can be granted read
and print permissions to the files on the switch.
•
Accounting —Records all user network service usage information, including the service type, start
time, and traffic. The accounting function not only provides the information required for charging
but also allows for network security surveillance.
AAA usually uses a client/server model. The client runs on the NAS, which is also referred to as the
access device. The server maintains user information centrally. In an AAA network, a NAS is a server for
users but a client for the AAA servers. See
Figure 1 .
Figure 1 Network diagram for AAA
When a user tries to log in to the NAS, use network resources, or access other networks, the NAS
authenticates the user. The NAS can transparently pass the user’s authentication, authorization, and
accounting information to the servers. The RADIUS and HWTACACS protocols define how a NAS and a
remote server exchange user information between them.
In the network shown in
Figure 1 , there is a RADIUS server and an HWTACACS server. You can choose
different servers for different security functions. For example, use the HWTACACS server for
authentication and authorization, and use the RADIUS server for accounting.
You can choose the three security functions provided by AAA as required. For example, if your
company only wants employees to be authenticated before they access specific resources, you only
need to configure an authentication server. If network usage information is needed, you must also
configure an accounting server.
AAA can be implemented through multiple protocols. The switch supports using RADIUS and
HWTACACS. RADIUS is often used in practice.