6
Configuring AAA
The HPE MSR series routers support EXEC user access.
The HPE MSR series routers do not support the attribute access-limit command.
The idle-cut enable command, which is used in ISP domain view to configure the idle cut function,
takes effect only on LAN users.
Overview
Authentication, Authorization, and Accounting (AAA) provides a uniform framework for implementing
network access management. It provides the following security functions:
• Authentication—Identifies users and determines whether a user is valid.
• Authorization—Grants user rights and controls user access to resources and services. For
example, a user who has successfully logged in to the device can be granted read and print
permissions to the files on the device.
• Accounting—Records all network service usage information, including service type, start time,
and traffic. The accounting function provides information required for charging, and allows for
network security surveillance.
AAA typically uses a client/server model, as shown in Figure 1. The client run
s on the network access
server (NAS), which is also called the access device. The server maintains user information centrally.
In an AAA network, the NAS is a server for users but a client for AAA servers.
Figure 1 AAA application scenario
The NAS uses the authentication server to authenticate any user who tries to log in, use network
resources, or access other networks. The NAS transparently transmits authentication, authorization,
and accounting information between the user and the servers. The RADIUS and HWTACACS
protocols define how a NAS and a remote server exchange user information.
The network shown in Figure 1 comp
rises a RADIUS server and an HWTACACS server. You can use
different servers to implement different security functions. For example, you can use the
HWTACACS server for authentication and authorization, and the RADIUS server for accounting.
You can implement any of the three security functions provided by AAA as needed. For example, if
your company wants employees to be authenticated before they access specific resources,
configure an authentication server. If network usage information is needed, you must also configure
an accounting server.
Remote user
NAS
RADIUS server
HWTACACS server
Internet
Network
To Next Page
Loading...
Need help?
General
