Specifications

Administrative AAA Configuration Scenarios
3-2 Configuring AAA for Administrative and Local Access
• Enabledmode.Toentertheenabledmodeofoperation,youtypetheenablecommandatthe
commandprompt.Inenabledmode,youcanuseallCLIcommands.AlthoughMSSdoesnot
requireanenablepassword,Enterasys Networkshighlyrecommendsthatyousetone.
• Customizedauthentication.Youcanrequireauthenticationforall
usersorforonlyasubsetof
users.Usernameglobbing(see“UserGlobs,MACAddressGlobs,andVLANGlobs”on
page 1‐4)allowsdifferentusersorclassesofusertobegivendifferentauthentication
treatments.YoucanconfigureconsoleauthenticationandTelnetauthenticationseparately,
andyoucanapplydifferentauthentication
methodstoeach.
Foranyuser,authorizationusesthesamemethod(s)asauthenticationforthatuser.
• Localoverride.Aspecialauthenticationtechniquecalledlocaloverrideletsyouattempt
authenticationviathelocaldatabasebeforeattemptingauthenticationviaaRADIUSserver.
TheRoamAboutSwitchattemptsadministrativeauthenticationinthelocaldatabasefirst.
Ifit
findsnomatch,theRoamAboutSwitchattemptsadministrativeauthenticationonthe
RADIUSserver.(ForinformationaboutsettingaRoamAboutSwitchtouseRADIUSservers,
seeChapter 18,ConfiguringCommunicationwithRADIUS.)
• Accountingforadministrativeaccesssessions.Accountingrecordscanbestoredand
displayedlocallyorsenttoa
RADIUSserver.Accountingrecordsprovideanaudittrailofthe
timeanadministrativeuserloggedin,theadministrator’susername,thenumberofbytes
transferred,andthetimethesessionstartedandended.
Figure 3‐1illustratesatypicalRoamAboutSwitch,accesspoints,andnetworkadministratorinan
enterprisenetwork.Asnetworkadministrator,
youinitiallyaccesstheRoamAboutSwitchviathe
console.Youcanthenoptionallyconfigureauthentication,authorization,and accountingfor
administrativeaccessmode.
Enterasys Networksrecommendsenforcingauthenticationforadministrativeaccessusing
usernamesandpasswordsstoredeitherlocallyoronRADIUSservers.