User's Manual

111
Users Manual of CS-6306R
The software attempts authentication with the next listed authentication method only when there is no
response from the previous method. If authentication fails at any point in this cycle—meaning that the security
server or local username database responds by denying the user access—the authentication process stops
and no other authentication methods are attempted. The following figures shows a typical AAA network
configuration that includes four security servers: R1 and R2 are RADIUS servers, and T1 and T2 are
TACACS+ servers.
Figure 6-1 Typical AAA Network Configuration
Suppose the system administrator has defined a method list where R1 will be contacted first for authentication
information, then R2, T1, T2, and finally the local username database on the access server itself. When a
remote user attempts to dial in to the network, the network access server first queries R1 for authentication
information. If R1 authenticates the user, it issues a PASS response to the network access server and the
user is allowed to access the network. If R1 returns a FAIL response, the user is denied access and the
session is terminated. If R1 does not respond, then the network access server processes that as an ERROR
and queries R2 for authentication information. This pattern continues through the remaining designated
methods until the user is either authenticated or rejected, or until the session is terminated. If all of the
authentication methods return errors, the network access server will process the session as a failure, and the
session will be terminated.
A FAIL response is significantly different from an ERROR. A FAIL means that the user has not met the criteria
contained in the applicable authentication database to be successfully authenticated. Authentication ends
with a FAIL response. An ERROR means that the security server has not responded to an authentication
query. Because of this, no authentication has been attempted. Only when an ERROR is detected will AAA
select the next authentication method defined in the authentication method list.
6.1.2 AAA Configuration Process
You must first decide what kind of security solution you want to implement. You need to assess the security
risks in your particular network and decide on the appropriate means to prevent unauthorized entry and
attack.