Configuring authentication methods for an ISP domain

In AAA, authentication, authorization, and accounting are separate processes. Authentication refers to the interactive authentication process of username/password/user information during an access or service request. The authentication process neither sends authorization information to a supplicant nor triggers any accounting.

AAA supports the following authentication methods:

You can configure AAA authentication to work alone without authorization and accounting. If you configure an authentication method that references a RADIUS scheme and an authorization method that does not reference a RADIUS scheme, AAA accepts only the authentication result from the RADIUS server. The Access-Accept message from the RADIUS server carries the authorization information, but the device ignores the information.

By default, an ISP domain uses the local authentication method.

Configuration prerequisites

Before configuring authentication methods, complete the following tasks:

Configuration guidelines

Follow these guidelines when you configure authentication methods:

Configuration procedure

To configure authentication methods for an ISP domain:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Enter ISP domain view.

domain isp-name

N/A

3. Specify the default authentication method for all types of users.

authentication default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] }

Optional.

The default authentication method is local for all types of users.

4. Specify the authentication method for LAN users.

authentication lan-access { local | none | radius-scheme radius-scheme-name [ local | none ] }

Optional.

The default authentication method is used by default.

5. Specify the authentication method for login users.

authentication login { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] }

Optional.

The default authentication method is used by default.

6. Specify the authentication method for portal users.

authentication portal { local | none | radius-scheme radius-scheme-name [ local ] }

Optional.

The default authentication method is used by default.

7. Specify the authentication method for privilege level switching.

authentication super { hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name }

Optional.

The default authentication method is used by default.