Operation Manual – AAAH3C S3100 Series Ethernet Switches Chapter 1 AAA Overview1-2z RADIUS authorization: Users are authorized after they pass RADIUSauthentication. In RADIUS protocol, authentication and authorization arecombined together, and authorization cannot be performed alone withoutauthentication.z HWTACACS authorization: Users are authorized by a TACACS server.1.1.3 AccountingAAA supports the following accounting methods:z None accounting: No accounting is performed for users.z Remote accounting: User accounting is performed on a remote RADIUS orTACACS server.1.1.4 Introduction to ISP DomainAn Internet service provider (ISP) domain is a group of users who belong to the sameISP. For a user name in the format of userid@isp-name or userid.isp-name, theisp-name following the "@" or “.” character is the ISP domain name. The access deviceuses userid as the user name for authentication, and isp-name as the domain name.In a multi-ISP environment, the users connected to the same access device maybelong to different domains. Since the users of different ISPs may have differentattributes (such as different forms of user name and password, different servicetypes/access rights), it is necessary to distinguish the users by setting ISP domains.You can configure a set of ISP domain attributes (including AAA policy, RADIUSscheme, and so on) for each ISP domain independently in ISP domain view.1.2 Introduction to AAA Services1.2.1 Introduction to RADIUSAAA is a management framework. It can be implemented by not only one protocol. Butin practice, the most commonly used service for AAA is RADIUS.I. What is RADIUSRADIUS (remote authentication dial-in user service) is a distributed service based onclient/server structure. It can prevent unauthorized access to your network and iscommonly used in network environments where both high security and remote useraccess service are required.The RADIUS service involves three components:z Protocol: Based on the UDP/IP layer, RFC 2865 and 2866 define the messageformat and message transfer mechanism of RADIUS, and define 1812 as theauthentication port and 1813 as the accounting port.
