Juniper JUNOSE 11.0.X MULTICAST ROUTING, Руководство по настройке

Страница: 352 / 788

Table 64: TACACS-Related Terms
Description Term
Network access server. A device that provides connections to a single user,
to a network or subnetwork, and to interconnected networks. In reference
to , the NAS is the E Series router. NAS
A program or software running on a security server that provides AAA
services using the protocol. The program processes
authentication, authorization, and accounting requests from an NAS. When
processing authentication requests, the process might respond to the NAS
with a request for additional information, such as a password. process
The security server on which the process is running. Also
referred to as a server. host
AAA Overview
allows effective communication of AAA information between NASs and
a central server. The separation of the AAA functions is a fundamental feature of the
design:
■
Authentication—Determines who a user is, then determines whether that user
should be granted access to the network. The primary purpose is to prevent
intruders from entering your networks. Authentication uses a database of users
and passwords.
■
Authorization—Determines what an authenticated user is allowed to do.
Authorization gives the network manager the ability to limit network services to
different users. Also, the network manager can limit the use of certain commands
to various users. Authorization cannot occur without authentication.
■
Accounting—Tracks what a user did and when it was done. Accounting can be
used for an audit trail or for billing for connection time or resources used.
Accounting can occur independent of authentication and authorization.
Central management of AAA means that the information is in a single, centralized,
secure database, which is much easier to administer than information distributed
across numerous devices. Both RADIUS and protocols are client-server
systems that allow effective communication of AAA information.
For information about RADIUS, see “Configuring Remote Access” on page 3.
Administrative Login Authentication
Fundamentally, provides the same services as RADIUS. Every
authentication login attempt on an NAS is verified by a remote process.
authentication uses three packet types. Start packets and Continue packets
are always sent by the user. Reply packets are always sent by the process.
312 ■
Overview
JUNOSe 11.0.x Broadband Access Configuration Guide