Nortel Networks 2300 AAA Methods for Ieee 802.1X and Web Network Access, AAA Rollover Process

412Configuring AAA for Network Users

AAA Methods for IEEE 802.1X and Web Network Access

The following AAA methods are supported by Nortelfor 802.1X and Web network access mode:

•Client certificates issued by a certificate authority (CA) for authentication.

(For this method, you assign an authentication protocol to a user. For protocol details, see “IEEE 802.1X Extensible Authentication Protocol Types” on page 415.)

•The WSS switch’s local database of usernames and user groups for authentication.

(For configuration details, see “Adding and Clearing Local Users for Administrative Access” on page 63, “Authenticating through a Local Database” on page 420, and “Adding and Clearing MAC Users and User Groups Locally” on page 426.)

•A named group of RADIUS servers. The WSS switch supports up to four server groups, which can each contain between one and four servers.

(For server group details, see “Configuring RADIUS Server Groups” on page 483.)

You can use the local database or RADIUS servers for MAC and last-resort access as well. If you use RADIUS servers, make sure you configure the password for the MAC address or last-resort user as nortel. (This is the default authoriza- tion password. To change it, see “Changing the MAC Authorization Password for RADIUS” on page 428.)

AAA Rollover Process

An WSS switch attempts AAA methods in the order in which they are entered in the configuration:

1The first AAA method in the list is used unless that method results in an error. If the method results in a pass or fail, the result is final and the WSS tries no other methods.

2If the WSS switch receives no response from the first AAA method, it tries the second method in the list.

3If the WSS switch receives no response from the second AAA method, it tries the third method. This evaluation process is applied to all methods in the list.

Note. If a AAA rule specifies local as a secondary AAA method, to be used if the RADIUS servers are unavailable, and WSS Software authenticates a client with the local method, WSS Software starts again at the beginning of the method list when attempting to authorize the client. This can cause unexpected delays during client processing and can cause the client to time out before completing logon.

Local Override Exception

The one exception to the operation described in “AAA Rollover Process” takes place if the local database is the first method in the list and is followed by a RADIUS server group method. If the local method fails to find a matching

320657-A