H3C Technologies H3C S5120 Series Switches - Manual (Page 415)

1-9
RADIUS Configuration Task List
Task Remarks
Creating a RADIUS Scheme Required
Specifying the RADIUS Authentication/Authorization Servers Required
Specifying the RADIUS Accounting Servers and Relevant Parameters Optional
Setting the Shared Key for RADIUS Packets Required
Setting the Upper Limit of RADIUS Request Retransmission Attempts Optional
Setting the Supported RADIUS Server Type Optional
Setting the Status of RADIUS Servers Optional
Configuring Attributes Related to Data to Be Sent to the RADIUS Server Optional
Enabling the RADIUS Trap Function Optional
Specifying the Source IP Address for RADIUS Packets to Be Sent Optional
Setting Timers Regarding RADIUS Servers Optional
Configuring RADIUS Accounting-On Optional
Enabling the Listening Port of the RADIUS Client Optional
Displaying and Maintaining RADIUS Optional
Configuring AAA
By configuring AAA, you can provide network access service for legal users, protect the networking
devices, and avoid unauthorized access and repudiation. In addition, you can configure ISP domains to
perform AAA on accessing users.
In AAA, users are divided into LAN users (such as 802.1X users) and login users (such as SSH, Telnet,
FTP, and terminal access users). Except for command line users, you can configure separate
authentication/authorization/accounting policies for all the other types of users. Command line users
can be configured with authorization policy independently.
Configuration Prerequisites
For remote authentication, authorization, or accounting, you must create the RADIUS scheme first. For
RADIUS scheme configuration, refer to Configuring RADIUS .
Creating an ISP Domain
An Internet service provider (ISP) domain represents a group of users belonging to it. For a username in
the userid@isp-name format, the access device considers the userid part the username for
authentication and the isp-name part the ISP domain name.
In a networking scenario with multiple ISPs, an access device may connect users of different ISPs. As
users of different ISPs may have different user attributes (such as username and password structure,
service type, and rights), you need to configure ISP domains to distinguish the users. In addition, you
need to configure different attribute sets including AAA methods for the ISP domains.