ZyXEL Communications GS1920-48HPv2, Руководство пользователя

Страница: 226 / 432

Chapter 25 AAA
GS1920v2 Series User’s Guide
226
Accounting is the process of recording what a user is doing. The Switch can use an external server to
track when users log in, log out, execute commands and so on. Accounting can also record system
related actions such as boot up and shut down times of the Switch.
Lo c a l Use r Ac c o unts
By storing user profiles locally on the Switch, your Switch is able to authenticate and authorize users
without interacting with a network AAA server. However, there is a limit on the number of users you may
authenticate in this way (See
Section 40.4 on page 354 ).
RADIUS a nd TAC AC S+
RADIUS and are security protocols used to authenticate users by means of an external server
instead of (or in addition to) an internal device user database that is limited to the memory capacity of
the device. In essence, RADIUS and authentication both allow you to validate an unlimited
number of users from a central location.
The following table describes some key differences between RADIUS and .
25.2 AAA Sc re e ns
The
AAA
screens allow you to enable authentication and authorization or both of them on the Switch.
First, configure your authentication server settings (RADIUS, or both) and then set up the
authentication priority, activate authorization.
Click
Adva nc e d Applic a tio n
>
AAA
in the navigation panel to display the screen as shown.
Fig ure 164
Advanced Application > AAA
25.3 RADIUS Se rve r Se tup
Use this screen to configure your RADIUS server settings. See RADIUS and on page 226 for more
information on RADIUS servers and Section 25.6.2 on page 233 for RADIUS attributes utilized by the
authentication features on the Switch. Click on the
RADIUS Se rve r Se tup
link in the
AAA
screen to view
the screen as shown.
Table 93 RADIUS vs.
RADIUS TAC AC S+
Transport
Protocol UDP (User Datagram Protocol) TCP (Transmission Control Protocol)
Encryption Encrypts the password sent for
authentication. All communication between the client (the Switch)
and the TACACS server is encrypted.