D-Link DWS-1008 Product Manual - Page 296

Accounting MSS also supports accounting. Accounting collects and sends information used for billing, auditing, and reporting-for example, user identities, connection start and stop times, the number of packets received and sent, and the number of bytes transferred. You can track sessions through accounting information stored locally or on a remote RADIUS server. Summary of AAA Features Depending on your network configuration, you can configure authentication, authorization, and accounting (AAA) for network users to be performed locally on the switch or remotely on a RADIUS server. The number of users that the local database can support depends on your platform. AAA for network users controls and monitors their use of the network: • Classification for customized access. As with administrative and console users, you can classify network users through username globbing. Based on the structured username, different AAA treatments can be given to different classes of user. For example, users in the human resources department can be authenticated differently from users in the sales department. • Authentication for full or limited access. IEEE 802.1X network users are authenticated when they identify themselves with a credential. Authentication can be passed through to RADIUS, performed locally on the switch, or only partially "offloaded" to the switch. Network users without 802.1X support can be authenticated by the MAC addresses of their devices. If neither 802.1X nor MAC authentication apply to the user, they can still be authenticated by a fallthru authentication type, either WebAAA or last-resort authentication. The default fallthru type is None, which denies access to users who do not match an 802.1X or MAC authentication rule. • Authorization for access control. Authorization provides access control by means of such mechanisms as per-user security access control lists (ACLs), VLAN membership, and timeout enforcement. Because authorization is always performed on network access users so they can use a particular VLAN, the switch automatically uses the same AAA method (RADIUS server group or local database) for authorization that you define for a user's authentication. • Local authorization control. You can override any AAA assignment of VLAN or security ACL for individual network users on a particular switch by configuring the location policy on the switch. • SSID default authorization attributes. You can configure service profiles with a set of default AAA authorization attributes that are used when the normal AAA process or a location policy does not provide them. • Accounting for tracking users and resources.Accounting collects and sends information used for billing, auditing, and reporting-for example, user identities, connection start and stop times, the number of packets received and sent, and the number of bytes transferred. You can track sessions through accounting information stored locally or on a remote RADIUS server. D-Link DWS-1008 User Manual 277