R3721-F3210-F3171-HP High-End Firewalls Access Control Configuration Guide-6PW101

159
• LAN users—Users on a LAN who must pass 802.1X authentication or MAC address authentication
to access the network.
• DVPN users.
• Login users—Users who want to log in to the NAS, including SSH users, Telnet users, Web users,
FTP users, and terminal users.
• Portal users—Users who must pass portal authentication to access the network.
• PPP users—Users who access through PPP.
• SSL VPN users—Users who access through SSL VPN.
In addition, AAA provides the following services for login users to enhance device security:
• Command authorization—Enables the NAS to defer to the authorization server to determine
whether a command entered by a login user is permitted for the user, making sure that login users
execute only commands they are authorized to execute. For more information about command
authorization, see Getting Started Guide.
• Command accounting—Allows the accounting server to record all commands executed on the NAS
or all authorized commands successfully executed. For more information about command
accounting, see Getting Started Guide.
• Level switching authentication—Allows the authentication server to authenticate users who perform
privilege level switching. As long as passing level switching authentication, users can switch their
user privilege levels, without logging out and disconnecting current connections. For more
information about user privilege level switching, see Getting Started Guide.
You can configure different authentication, authorization, and accounting methods for different users in
a domain. See "
HWTACACS scheme configuration guidelines"
AAA across VPNs
In a VPN scenario where clients in different VPNs are centrally authenticated, you can deploy AAA
across VPNs to enable forwarding of RADIUS and HWTACACS packets across VPNs. As shown
in Figure 136,
the PE at the left side of the MPLS backbone serves as a NAS and transparently delivers
the AAA packets of private users in VPN 1 and VPN 2 to the AAA servers in VPN 3 for centralized
authentication. Authentication packets of private users in different VPNs do not affect each other.
Figure 136 Network diagram for AAA across VPNs
P
MPLS backbone
PE
PE
CE
VPN 1
VPN 2
VPN 3
RADIUS
server
HWTACACS
server
Host
Host
NAS
MCE