Ruijie RG-S2900G-E Series, Руководство по настройке

Страница: 453 / 943

Configuration Guide AAA Configuration
If the system administrator hopes to apply this method list on a specific Login connection,
he/she must create a named method list and then apply it on the specific connection. The
example below shows how to apply the authentication method list on line 2 only.
Command Function
configure terminal
Enter the global configuration mode.
aaa new-model Turn on the AAA switch.
aaa authentication login test
group radius local
Define a method list named "test" in the global
configuration mode.
line vty 2 Enter the configuration layer of line 2
login authentication test
In the line configuration mode, apply the
method list named “test” on the line.
If a remote PC user attempts to Telnet the network access server(NAS), the NAS first queries
the authentication information from R1. If the user passes the authentication on R1, R1 sends
a ACCEPT reply to the NAS, and thus the user's access to the network is allowed. If R1
returns the REJECT reply, the user's access is refused and then disconnected.If R1 does not
respond, NAS considers TIMEOUT and queries the authentication information to R2. This
process continues for the remaining methods till the user passes the authentication, is refused
or the session is terminated. If all servers (R1 and R2) returns TIMEOUT, the authentication
will be performed by the NAS local database.
Caution
The REJECT response is not the same as the TIMEOUT response. REJECT
means the user fails to comply with the standard in the available authentication
database and does not pass the authentication, thus the access request will be
refused. TIMEOUT means there is no reply from the security server to the
authentication. When an TIMEOUT is detected, the AAA selects the next
authentication method in the method list to continue the authentication process.
Authentication Type
Ruijie products support the following authentication types:

Login Authentication -- the authentication of the user terminal logging in the NAS CLI.

Enable Authentication -- the authentication of improving the CLI authority after the user
terminal loggs in the NAS CLI.

PPP Authentication -- the authentication of PPP dial user.

DOT1X(IEEE802.1x) Authentication -- the authentication of the IEEE802.1x access user.
General Steps in Configuring AAA Authentication
The following tasks are common for the configuration of AAA authentication.

Enable AAA by using the global configuration command aaa new-model .