Siklu EtherHaul - 14 System Administration; TACACS+;RADIUS Users Administration

EtherHaul Operation, Administration and Maintenance Manual
Page 127
14 System Administration
This chapter describes the system's administration capabilities and procedures and
includes the following topics:
 Users Administration
 SNMPv3 Users Configuration
 Zero-Touch Configuration
 Monitoring CLI Login Sessions
 DHCP Relay (Option 82)
14.1 TACACS+/RADIUS Users Administration
The EtherHaul supports both internal user management and with external Radius or
TACACS server.
To administrate users, refer to the Users Administration section in the Network Page.
The page will be updated based on the selected Authentication Mode.
For internal user management (standard user/passwords that are configured in the
device), select Local as the Authentication Mode.
Local users administration (default mode) is described in the to the Users Administration
section under Network Configuration and Monitoring chapter of this manual.
14.1.1 AAA Description
RADIUS (Remote Authentication Dial-In User Service) and TACACS+ (Terminal Access
Controller Access-Control System) are AAA mechanisms.
 Authentication: Identification of requester profile (username, password, and
privilege level) on a per-request basis.
 Authorization: Permission/denial of access to a subset of commands subject to
authentication success/failure. (The mechanisms of Authorization and
authentication are independent of each other.)
 Accounting: Reporting of information on requesters (identities, number of
access attempts per requester, start and stop times, executed commands, etc.)
The EtherHaul is a Network Access Server (NAS) for requesters and functions as AAA
client passing requester information (e.g. username, password, etc.). The AAA Server is
responsible for receiving connection requests, authenticating or disqualifying the
requester, and sending the permit or denies response to the EtherHaul client.
Communication between the EtherHaul and the AAA Server are permitted by shared
secrets which are never sent over the network. In addition, every administrator