User Guide

410 Configuring AAA for Network Users
320657-A
Summary of AAA Features
Depending on your network configuration, you can configure authentication, authorization, and accounting
(AAA) for network users to be performed locally on the WSS switch or remotely on a RADIUS server. The
number of users that the local WSS database can support depends on your platform.
AAA for network users controls and monitors their use of the network:
• Classification for customized access. As with administrative and console users, you can classify
network users through username wildcarding. Based on the structured username, different AAA
treatments can be given to different classes of user. For example, users in the human resources
department can be authenticated differently from users in the sales department.
• Authentication for full or limited access. IEEE 802.1X network users are authenticated when they
identify themselves with a credential. Authentication can be passed through to RADIUS, performed
locally on the WSS switch, or only partially “offloaded” to the switch. Network users without 802.1X
support can be authenticated by the MAC addresses of their devices. If neither 802.1X nor MAC
authentication apply to the user, they can still be authenticated by a fallthru method, either Web-based
AAA or last-resort authentication. Optionally, you can disable the fallthru option by setting the fallthru
type to none.
• Authorization for access control. Authorization provides access control by means of such mechanisms
as per-user security access control lists (ACLs), VLAN membership, Mobility Domain assignment, and
timeout enforcement. Because authorization is always performed on network access users so they can use
a particular VLAN, the WSS automatically uses the same AAA method (RADIUS server group or local
database) for authorization that you define for a user’s authentication.
• Local authorization control. You can override any AAA assignment of VLAN or security ACL for
individual network users on a particular WSS switch by configuring the location policy on the WSS.
• Accounting for tracking users and resources. Accounting collects and sends information used for
billing, auditing, and reporting—for example, user identities, connection start and stop times, the number
of packets received and sent, and the number of bytes transferred. You can track sessions through
accounting information stored locally or on a remote RADIUS server. As network users roam throughout
a Mobility Domain, accounting records track them and their network usage.
AAA Tools for Network Users
Authentication verifies network user identity and is required before a network user is granted access to the
network. An WSS switch authenticates user identity by username-password matching, digital signatures and
certificates, or other methods (for example, by MAC address).
You must decide whether to authenticate network users locally on the WSS, remotely through one or more
external RADIUS server groups, or both locally and remotely. (For server group details, see “Configuring
RADIUS Server Groups” on page 483.)