HP E3800 Series, Руководство по обеспечению безопасности доступа

Страница: 227 / 732

6-11
RADIUS Authentication, Authorization, and Accounting
Configuring the Switch for RADIUS Authentication
Figure 6-2 shows an example of the
show authentication
command displaying
authorized
as the secondary authentication method for port-access, Web-auth
access, and MAC-auth access. Since the configuration of
authorized
means no
authentication will be performed and the client has unconditional access to
the network, the “Enable Primary” and “Enable Secondary” fields are not
applicable (N/A).
Figure 6-2. Example of AAA Authentication Using Authorized for the Secondary Authentication Method
Suppose you already configured local passwords on the switch, but want
RADIUS to protect primary Telnet and SSH access without allowing a second-
ary Telnet or SSH access option (the switch’s local passwords):
HP Switch(config)# show authentication
Status and Counters - Authentication Information
Login Attempts : 3
Respect Privilege : Disabled
| Login Login Login
Access Task | Primary Server Group Secondary
----------- + ---------- ------------ ----------
Console | Local None
Telnet | Local None
Port-Access | Local Authorized
Webui | Local None
SSH | Local None
Web-Auth | ChapRadius radius Authorized
MAC-Auth | ChapRadius radius None
| Enable Enable Enable
Access Task | Primary Server Group Secondary
----------- + ---------- ------------ ----------
Console | Local None
Telnet | Local None
Webui | Local None
SSH | Local None
The access methods
with secondary
authentication
configured as
authorized
allows the client access
to the network even if the
RADIUS server is
unreachable.