To Next Page

To Previous Page

1-36

[Switch-ui-vty0-4] quit

# Configure the HWTACACS scheme.

[Switch] hwtacacs scheme hwtac

[Switch-hwtacacs-hwtac] primary authentication 10.1.1.1 49

[Switch-hwtacacs-hwtac] primary authorization 10.1.1.1 49

[Switch-hwtacacs-hwtac] primary accounting 10.1.1.1 49

[Switch-hwtacacs-hwtac] key authentication expert

[Switch-hwtacacs-hwtac] key authorization expert

[Switch-hwtacacs-hwtac] key accounting expert

[Switch-hwtacacs-hwtac] user-name-format without-domain

[Switch-hwtacacs-hwtac] quit

# Configure the AAA methods for the domain.

[Switch] domain bbb

[Switch-isp-bbb] authentication login hwtacacs-scheme hwtac

[Switch-isp-bbb] authorization login hwtacacs-scheme hwtac

[Switch-isp-bbb] accounting login hwtacacs-scheme hwtac

[Switch-isp-bbb] quit

# You can achieve the same result by setting default AAA methods for all types of users.

[Switch] domain bbb

[Switch-isp-bbb] authentication default hwtacacs-scheme hwtac

[Switch-isp-bbb] authorization default hwtacacs-scheme hwtac

[Switch-isp-bbb] accounting default hwtacacs-scheme hwtac

When telneting into the switch, a user enters username userid@bbb for authentication using domain

bbb.

AAA for Telnet Users by Separate Servers

Network requirements

As shown in Figure 1-8, configure the switch to provide local authentication, HWTACACS authorization,

and RADIUS accounting services to Telnet users. The user name and the password for Telnet users are

both hello.

z The HWTACACS server is used for authorization. Its IP address is 10.1.1.2. On the switch, set the

shared keys for packets exchanged with the HWTACACS server to expert. Configure the switch to

remove the domain name from a user name before sending the user name to the HWTACACS

server.

z The RADIUS server is used for accounting. Its IP address is 10.1.1.1. On the switch, set the shared

keys for packets exchanged with the RADIUS server to expert.

Configuration of separate AAA for other types of users is similar to that given in this example. The only

difference lies in the access type.

H3C S5120-EI Series User Manual

Other manuals for H3C S5120-EI Series