3Com WX3000 Configuring Dynamic Vlan Assignment, Local local none Authorization none

You can use an arbitrary combination of the above implementations for your AAA scheme configuration.

2)For FTP users

Only authentication is supported for FTP users.

Authentication: RADIUS, local, or HWTACACS.

Follow these steps to configure separate AAA schemes:

To do…	Use the command…	Remarks
Enter system view	system-view	—
Create an ISP domain and
enter its view, or enter the view	domain isp-name	Required
of an existing ISP domain
	authentication	Optional
Configure an authentication	{ radius-scheme
	radius-scheme-name [ local ]	By default, no separate
scheme for the ISP domain	hwtacacs-scheme	authentication scheme is
	hwtacacs-scheme-name	configured.
	[ local ] local none }
	authorization { none	Optional
Configure an authorization		By default, no separate
	hwtacacs-scheme
scheme for the ISP domain		authorization scheme is
	hwtacacs-scheme-name }
		configured.
	accounting { none	Optional
Configure an accounting	radius-scheme	By default, no separate
	radius-scheme-name
scheme for the ISP domain		accounting scheme is
	hwtacacs-scheme
		configured.
	hwtacacs-scheme-name }

z

z

If a combined AAA scheme is configured as well as the separate authentication, authorization and accounting schemes, the separate ones will be adopted in precedence.

RADIUS scheme and local scheme do not support the separation of authentication and authorization. Therefore, pay attention when you make authentication and authorization configuration for a domain: When the scheme radius-schemeor scheme local command is executed and the authentication command is not executed, the authorization information returned from the RADIUS or local scheme still takes effect even if the authorization none command is executed.

Configuring Dynamic VLAN Assignment

The dynamic VLAN assignment feature enables a device to dynamically add the ports of successfully authenticated users to different VLANs according to the attributes assigned by the RADIUS server, so as to control the network resources that different users can access.

Currently, the device supports the following two types of assigned VLAN IDs: integer and string.

zInteger: If the RADIUS authentication server assigns integer type of VLAN IDs, you can set the VLAN assignment mode to integer on the device (this is also the default mode on the device). Then,

2-5