HP VPN Firewall Appliances Getting Started Guide

109
execute only basic commands like ping and tracert and use a few display commands. The switching
operation is effective for the current login. After the user relogs in, the user privilege restores to the
original level.
To prevent problems, HP recommends that administrators log in with a lower privilege level to view switch
operating parameters, and switch to a higher level temporarily only when they must maintain the device.
When administrators must leave for a while or ask someone else to manage the device temporarily, they
can switch to a lower privilege level before they leave to restrict the operation by others.
Configuring the authentication parameters for user privilege level switching
A user can switch to a lower privilege level without authentication. To switch to a higher privilege level,
however, a user must provide the privilege level switching authentication information (if any). Table 18
shows the priv
ilege level switching authentication modes supported by the device.
Table 18 Privilege level switching authentication modes
Authentication mode Ke
y
words Descri
p
tion
Local password
authentication only
(local-only)
local
The device uses the locally configured passwords for privilege level
switching authentication.
To use this mode, you must set the passwords for privilege level
switching using the super password command.
Remote AAA
authentication through
HWTACACS or
RADIUS
scheme
The device sends the username and password for privilege level
switching to the HWTACACS or RADIUS server for remote
authentication.
To use this mode, you must perform the following configuration tasks:
• Configure the required HWTACACS or RADIUS schemes and
configure the ISP domain to use the schemes for users. For more
information, see Access Control Configuration Guide.
• Add user accounts and specify the user passwords on the
HWTACACS or RADIUS server.
Local password
authentication first and
then remote AAA
authentication
local
scheme
The device first uses the locally configured passwords for privilege
level switching authentication. If no local password is set, the device
allows console users to switch their privilege levels without
authentication, but performs AAA authentication for VTY users.
Remote AAA
authentication first and
then local password
authentication
scheme
local
AAA authentication is performed first, and if the remote HWTACACS
or RADIUS server does not respond or AAA configuration on the
device is invalid, the local password authentication is performed.
To configure the authentication parameters for a user privilege level:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Set the authentication
mode for user privilege
level switching.
super authentication-mode
{ local | scheme } *
Optional.
By default, local-only authentication is used.