Configuration Guide Configuring AAA
EXEC authorization is often used with login authentication, which can be implemented on the same line. Authorization
and authentication can be performed using different methods and servers. Therefore, the results of the same user may
be different. If a user passes login authentication but fails in EXEC authorization, the user cannot enter the CLI.
The authorization methods in an authorization scheme are executed in accordance with the method configuration
sequence. The next authorization method is executed only when the current method does not receive response. If
authorization fails using a method, the next method will be not tried.
Command authorization is supported only by TACACS+.
Console authorization: The RGOS can differentiate between the users who log in through the Console and the users
who log in through other types of clients. You can enable or disable command authorization for the users who log in
through the Console. If command authorization is disabled for these users, the command authorization method list
applied to the Console line no longer takes effect.
Configuration Steps
Enabling AAA
Mandatory.
Run the aaa new-model command to enable AAA.
By default, AAA is disabled.
Defining a Method List of EXEC Authorization
Run the aaa authorization exec command to configure a method list of EXEC authorization.
This configuration is mandatory if you need to configure an EXEC authorization method list (including the configuration
of the default method list).
By default, no EXEC authorization method list is configured.
The default access permission level of EXEC users is the lowest. (Console users can connect to the NAS through the
Console port or Telnet. Each connection is counted as an EXEC user, for example, a Telnet user and SSH user.)
Defining a Method List of Command Authorization
Run the aaa authorization commands command to configure a method list of command authorization.
This configuration is mandatory if you need to configure a command authorization method list (including the
configuration of the default method list).
By default, no command authorization method list is configured.
Configuring a Method List of Network Authorization
Run the aaa authorization network command to configure a method list of network authorization.
This configuration is mandatory if you need to configure a network authorization method list (including the configuration
of the default method list).
By default, no authorization method is configured.
To Next Page
Loading...
Need help?
General
