User's Manual

85
sequence of the method list follows the name. The default method list is automatically applied to all interfaces.
When a remote user attempts to dial in to the network, the network access server first queries R1 for
authentication information. If R1 authenticates the user, it issues a PASS response to the network access
server and the user is allowed to access the network. If R1 returns a FAIL response, the user is denied access
and the session is terminated. If R1 does not respond, then the network access server processes that as an
ERROR and queries R2 for authentication information. This pattern continues through the remaining
designated methods until the user is either authenticated or rejected, or until the session is terminated.
A FAIL response is significantly different from an ERROR. A FAIL means that the user has not met the criteria
contained in the applicable authentication database to be successfully authenticated. Authentication ends with
a FAIL response. An ERROR means that the security server has not responded to an authentication query.
Only when an ERROR is detected will AAA select the next authentication method defined in the authentication
method list.
Suppose the system administrator wants to apply the method list to a certain or a specific port. In such case,
the system administrator should create a non-default method list and then apply the list of this name to an
appropriate port.
8.1.5 AAA Configuration Process
You must first decide what kind of security solution you want to implement. You need to assess the security
risks in your particular network and decide on the appropriate means to prevent unauthorized entry and attack.
Before you configure AAA, you need know the basic configuration procedure. To do AAA security configuration
on SWITCH or access servers, perform the following steps:
 If you decide to use a security server, configure security protocol parameters first, such as
RADIUS, TACACS+, or Kerberos.
 Define the method lists for authentication by using an AAA authentication command.
 Apply the method lists to a particular interface or line, if required.
 (Optional) Configure authorization using the aaa authorization command.
 (Optional) Configure accounting using the aaa accounting command.
8.2 Authentication Configuration
8.2.1 AAA Authentication Configuration Task List
 Configuring Login Authentication Using AAA
 Configuring PPP Authentication Using AAA
 Enabling Password Protection at the Privileged Level
 Configuring Message Banners for AAA Authentication
 Modifying the Notification Character String for Username Input
 Modifying AAA authentication password-prompt
 Creating local user name authentication database
 Creating the Authentication Database with the Local Privilege