H3C LS-3100-52P-OVS-H3 Operation Manual - page 1315
1-12
HWTACACS Configuration Task List
Task
Remarks
Creating a HWTACACS scheme
Required
Specifying the HWTACACS Authentication Servers
Required
Specifying the HWTACACS Authorization Servers
Optional
Specifying the HWTACACS Accounting Servers
Optional
Setting the Shared Key for HWTACACS Packets
Required
Configuring Attributes Related to the Data Sent to HWTACACS Server
Optional
Setting Timers Regarding HWTACACS Servers
Optional
Displaying and Maintaining HWTACACS
Optional
Configuring AAA
By configuring AAA, you can provide network access service for legal users, protect the networking
devices, and avoid unauthorized access and repudiation. In addition, you can configure ISP domains to
perform AAA on accessing users.
In AAA, users are divided into LAN users (such as 802.1x users and MAC authentication users), login
users (such as SSH, Telnet, FTP, and terminal access users), portal users and command line users
(that is, command line authentication users). Except for command line users, you can configure
separate authentication/authorization/accounting policies for all the other types of users. Command line
users can be configured with authorization policy independently.
Configuration Prerequisites
For remote authentication, authorization, or accounting, you must create the RADIUS or HWTACACS
scheme first. For RADIUS scheme configuration, refer to
Configuring RADIUS
. For HWTACACS
scheme configuration, refer to
Configuring HWTACACS
.
Creating an ISP Domain
An Internet service provider (ISP) domain represents a group of users belonging to it. For a username in
the userid@isp-name format, the access device considers the userid part the username for
authentication and the isp-name part the domain name.
In a networking scenario with multiple ISPs, an access device may connect users of different ISPs. As
users of different ISPs may have different user attributes (such as username and password structure,
service type, and rights), you need to configure ISP domains to distinguish the users. In addition, you
need to configure different attribute sets including AAA methods for the ISP domains.
For the NAS, each user belongs to an ISP domain. Up to 16 ISP domains can be configured on a NAS.
If a user does not provide the ISP domain name, the system considers that the user belongs to the
default ISP domain.