Creating an ISP domain
In a networking scenario with multiple ISPs, the device can connect to users of different ISPs. These users can have different user attributes, such as different username and password structures, different service types, and different rights. To manage users of different ISPs, configure ISP domains, and configure AAA methods and domain attributes for each ISP domain as needed.
The device supports a maximum of 16 ISP domains, including the system-defined ISP domain system. You can specify one of the ISP domains as the default domain. You can modify the settings of the ISP domain system, but you cannot delete the domain.
On the device, each user belongs to an ISP domain. If a user does not provide an ISP domain name at login, the device considers the user belongs to the default ISP domain.
The device chooses an authentication domain for each user in the following order:
The authentication domain specified for the access module.
The ISP domain in the username.
The default ISP domain of the device.
If the chosen domain does not exist on the device, the device searches for the ISP domain that accommodates users that are assigned to nonexistent domains. If no such ISP domain is configured, user authentication fails.
An ISP domain cannot be deleted when it is the default ISP domain. Before you use the undo domain command, change the domain to a non-default ISP domain by using the undo domain default enable command.
To create an ISP domain:
Step | Command | Remarks |
|---|---|---|
1. Enter system view. | system-view | N/A |
2. Create an ISP domain and enter ISP domain view. | domain isp-name | N/A |
3. Return to system view. | quit | N/A |
4. (Optional.) Specify the default ISP domain. | domain default enable isp-name | By default, the default ISP domain is the system-defined ISP domain system. |
5. (Optional.) Specify an ISP domain to accommodate users that are assigned to nonexistent domains. | domain if-unknown isp-domain-name | By default, no ISP domain is specified to accommodate users that are assigned to nonexistent domains. This feature is available in Release 1122P02 and later. |