Nortel Networks 2300 manual AAA Tools for Network Users, Summary of AAA Features

410Configuring AAA for Network Users

Summary of AAA Features

Depending on your network configuration, you can configure authentication, authorization, and accounting

(AAA)for network users to be performed locally on the WSS switch or remotely on a RADIUS server. The number of users that the local WSS database can support depends on your platform.

AAA for network users controls and monitors their use of the network:

•Classification for customized access. As with administrative and console users, you can classify network users through username wildcarding. Based on the structured username, different AAA treatments can be given to different classes of user. For example, users in the human resources department can be authenticated differently from users in the sales department.

•Authentication for full or limited access. IEEE 802.1X network users are authenticated when they identify themselves with a credential. Authentication can be passed through to RADIUS, performed locally on the WSS switch, or only partially “offloaded” to the switch. Network users without 802.1X support can be authenticated by the MAC addresses of their devices. If neither 802.1X nor MAC authentication apply to the user, they can still be authenticated by a fallthru method, either Web-based AAA or last-resort authentication. Optionally, you can disable the fallthru option by setting the fallthru type to none.

•Authorization for access control. Authorization provides access control by means of such mechanisms as per-user security access control lists (ACLs), VLAN membership, Mobility Domain assignment, and timeout enforcement. Because authorization is always performed on network access users so they can use a particular VLAN, the WSS automatically uses the same AAA method (RADIUS server group or local database) for authorization that you define for a user’s authentication.

•Local authorization control. You can override any AAA assignment of VLAN or security ACL for individual network users on a particular WSS switch by configuring the location policy on the WSS.

•Accounting for tracking users and resources. Accounting collects and sends information used for billing, auditing, and reporting—for example, user identities, connection start and stop times, the number of packets received and sent, and the number of bytes transferred. You can track sessions through accounting information stored locally or on a remote RADIUS server. As network users roam throughout a Mobility Domain, accounting records track them and their network usage.

AAA Tools for Network Users

Authentication verifies network user identity and is required before a network user is granted access to the network. An WSS switch authenticates user identity by username-password matching, digital signatures and certificates, or other methods (for example, by MAC address).

You must decide whether to authenticate network users locally on the WSS, remotely through one or more external RADIUS server groups, or both locally and remotely. (For server group details, see “Configuring RADIUS Server Groups” on page 483.)

320657-A