ZyXEL MGS-3712F User Guide - Page 222

Chapter 25 AAA 25.1.2 on page 222) as external authentication, authorization and accounting servers. Figure 117 AAA Server Client AAA Server 25.1.1 Local User Accounts By storing user profiles locally on the Switch, your Switch is able to authenticate and authorize users without interacting with a network AAA server. However, there is a limit on the number of users you may authenticate in this way (See Chapter 33 on page 297). 25.1.2 RADIUS and TACACS+ RADIUS and TACACS+ are security protocols used to authenticate users by means of an external server instead of (or in addition to) an internal device user database that is limited to the memory capacity of the device. In essence, RADIUS and TACACS+ authentication both allow you to validate an unlimited number of users from a central location. The following table describes some key differences between RADIUS and TACACS+. Table 65 RADIUS vs TACACS+ RADIUS Transport Protocol UDP (User Datagram Protocol) Encryption Encrypts the password sent for authentication. TACACS+ TCP (Transmission Control Protocol) All communication between the client (the Switch) and the TACACS server is encrypted. 25.2 AAA Screens The AAA screens allow you to enable authentication, authorization, accounting or all of them on the Switch. First, configure your authentication and accounting server settings (RADIUS, TACACS+ or both) and then set up the authentication priority, activate authorization and configure accounting settings. 222 MGS-3712/MGS-3712F User's Guide