R3303-HP HSR6800 Routers Security Configuration Guide

• Portal users—Users who must pass portal authentication to access the network.

• PPP users—Users who access through PPP.

• SSL VPN users—Users who access through SSL VPN.

In addition, AAA provides the following services for login users to enhance device security:

• Command authorization—Enables the NAS to defer to the authorization server to determine

whether a command entered by a login user is permitted, and allows login users to execute only

authorized commands. For more information about command authorization, see Fundamentals

Configuration Guide.

• Command accounting—Allows the accounting server to record all commands executed on the

device or all authorized commands successfully executed. For more information about command

accounting, see Fundamentals Configuration Guide.

• Level switching authentication—Allows the authentication server to authenticate users who perform

privilege level switching. As long as passing level switching authentication, users can switch their

user privilege levels, without logging out and disconnecting current connections. For more

information about user privilege level switching, see Fundamentals Configuration Guide.

You can configure different AAA methods for different types of users in a domain. See "Configuring AAA

meth

ods for ISP domains."

AAA for MPLS L3VPNs

In an MPLS L3VPN scenario where clients in different VPNs are centrally authenticated, you can deploy

AAA across VPNs to enable forwarding of RADIUS and HWTACACS packets across MPLS VPNs. With

this feature, the PE at the left side of the MPLS backbone serves as a NAS and transparently delivers the

AAA packets of private users in VPN 1 and VPN 2 to the AAA servers in VPN 3 for centralized

authentication, as shown in Figure 8. A

uthentication packets of private users in different VPNs do not

affect each other.

Figure 8 Network diagram

This feature can help a multi-VPN-instance CE to implement portal authentication for VPNs. For more

information about multi-VPN-instance CEs, see MPLS Configuration Guide. For more information about

portal authentication, see "Configuring portal."

Protocols and standards

The following protocols and standards are related to AAA, RADIUS, and HWTACACS: