Home » ZyXEL Manuals » Networking » ZyXEL VES1724-56 » Manual Viewer

ZyXEL VES1724-56 User Guide - Page 233

Authentication and Accounting

Add to My Manuals
Save this manual to your list of manuals

Page 233 highlights

CHAPTER 25 Authentication and Accounting This chapter describes how to configure authentication and accounting settings on the Switch. 25.1 Authentication, Authorization and Accounting Authentication is the process of determining who a user is and validating access to the Switch. The Switch can authenticate users who try to log in based on user accounts configured on the Switch itself. The Switch can also use an external authentication server to authenticate a large number of users Authorization is the process of determining what a user is allowed to do. Different user accounts may have higher or lower privilege levels associated with them. For example, user A may have the right to create new login accounts on the Switch but user B cannot. The Switch can authorize users based on user accounts configured on the Switch itself or it can use an external server to authorize a large number of users. Accounting is the process of recording what a user is doing. The Switch can use an external server to track when users log in, log out, execute commands and so on. Accounting can also record system related actions such as boot up and shut down times of the Switch. The external servers that perform authentication, authorization and accounting functions are known as AAA servers. The Switch supports RADIUS (Remote Authentication Dial-In User Service, see Section 25.1.2 on page 234) and TACACS+ (Terminal Access Controller Access-Control System Plus, see Section 25.1.2 on page 234) as external authentication, authorization and accounting servers. Figure 137 AAA Server Client Auth Server 25.1.1 Local User Accounts By storing user profiles locally on the Switch, your Switch is able to authenticate and authorize users without interacting with a network authentication server. However, there is a limit on the number of users you may authenticate in this way (See Chapter 37 on page 313). VES1724-56 User's Guide 233

Section	Page
VES1724-56	1
Contents Overview	3
Table of Contents	5
User’s Guide	17
Getting to Know Your Switch	19
1.1 Introduction	19
1.2 Applications	19
1.2.1 MTU Application	19
1.2.2 Curbside Application	20
1.3 Ways to Manage the Switch	21
1.4 Good Habits for Managing the Switch	21
Hardware Installation and Connection	23
2.1 Installation Scenarios	23
2.2 Desktop Installation Procedure	23
2.3 Mounting the Switch on a Rack	24
2.3.1 Rack-mounted Installation Requirements	24
2.3.2 Attaching the Mounting Brackets to the Switch	24
2.3.3 Mounting the Switch on a Rack	25
2.4 Connecting the Frame Ground	25
Hardware Overview	27
3.1 Front Panel	27
3.1.1 Power Connector	27
3.1.2 Gigabit Ethernet Ports	28
3.1.3 Mini-GBIC Slots	29
3.1.4 Management Port	30
3.1.5 Console Port	31
3.1.6 ALARM Slot	31
3.2 LEDs	32
The Web Configurator	35
4.1 Introduction	35
4.2 System Login	35
4.3 The Port Status Screen	36
4.3.1 Change Your Password	41
4.4 Saving Your Configuration	41
4.5 Switch Lockout	41
4.6 Resetting the Switch	42
4.6.1 Reload the Configuration File	42
4.7 Logging Out of the Web Configurator	43
4.8 Help	43
Initial Setup Example	44
5.1 Overview	44
5.2 Configuring Switch Management IP Address	44
5.2.1 Creating a VLAN	45
5.2.2 Setting Port VID	46
Tutorials	48
6.1 How to Use DHCP Relay Per VLAN on the Switch	48
6.1.1 DHCP Relay Tutorial Introduction	48
6.1.2 Creating a VLAN	48
6.1.3 Configuring Management IP Address	50
6.1.4 Configuring DHCP VLAN Settings	51
6.1.5 Testing the Connection	52
Technical Reference	53
System Status and Port Statistics	55
7.1 Overview	55
7.2 Port Status Summary	55
7.2.1 VDSL Port Status Change	56
7.2.2 VDSL Port Details	57
7.2.3 VDSL Summary	67
7.2.4 VTUR Counter	68
7.2.5 Port Details	70
Basic Setting	73
8.1 Overview	73
8.2 System Information	74
8.3 General Setup	76
8.4 Introduction to VLANs	77
8.5 Switch Setup Screen	78
8.6 IPv6 Introduction	79
8.6.1 IPv6 Addressing	80
8.6.2 IPv6 Prefix and Prefix Length	80
8.6.3 IPv6 Subnet Masking	80
8.6.4 Interface ID	80
8.6.5 Link-local Address	80
8.6.6 Global Address	81
8.6.7 Unspecified	81
8.6.8 EUI-64	81
8.6.9 Stateless Autoconfiguration	81
8.7 IP Setup	82
8.7.1 Management IP Addresses	82
8.7.2 IPv6 Setup	85
8.8 Port Setup	87
8.9 Remote CPE Configuration	89
8.9.1 Remote CPE Configuration Information	95
8.10 Rate Limit Profile Setup	95
8.10.1 Per Queue Ratelimit Profile	97
8.11 Hardware Alarm Profile	98
VDSL Setup	99
9.1 VDSL Overview	99
9.1.1 VDSL Profile Example	103
9.1.2 Primary and Fallback VDSL Templates Example	104
9.2 VDSL Line Setup	105
9.3 VDSL Template Setup	106
9.3.1 VDSL Line Profile Setup	108
9.3.2 VDSL Line Profile Setup > Rate Adaptive	111
9.3.3 VDSL Line Profile Setup > MIB PSD Mask	113
9.3.4 VDSL Line Profile Setup > DPBO	114
9.3.5 VDSL Line Profile Setup > RFI Band	115
9.3.6 VDSL Line Profile Setup > Virtual Noise	117
9.3.7 VDSL Channel Profile Setup	118
9.3.8 VDSL G.INP Setup	120
9.3.9 VDSL INM Profile Setup	121
9.4 VDSL Alarm Template Setup	123
9.4.1 VDSL Line Alarm Profile Setup	124
9.4.2 VDSL Channel Alarm Profile Setup	126
VLAN	129
10.1 Introduction to IEEE 802.1Q Tagged VLANs	129
10.1.1 Forwarding Tagged and Untagged Frames	129
10.1.2 VLAN Tagging Priority	130
10.2 Automatic VLAN Registration	130
10.2.1 GARP	130
10.2.2 GVRP	130
10.3 Port VLAN Trunking	131
10.4 Select the VLAN Type	131
10.5 Static VLAN	132
10.5.1 Static VLAN Status	132
10.5.2 VLAN Details	133
10.5.3 Configure a Static VLAN	134
10.5.4 Configure a VLAN Profile	135
10.5.5 Configure VLAN Port Settings	137
10.6 Subnet Based VLANs	138
10.7 Configuring Subnet Based VLAN	139
10.8 Protocol Based VLANs	141
10.9 Configuring Protocol Based VLAN	142
10.10 Create an IP-based VLAN Example	143
10.11 Configuring MAC Based VLAN	144
10.12 Port Based VLAN Setup	146
10.12.1 Configure a Port Based VLAN	147
10.13 VLAN Counter	150
Static MAC Forward Setup	152
11.1 Overview	152
11.2 Configuring Static MAC Forwarding	152
Static Multicast Forward Setup	154
12.1 Static Multicast Forwarding Overview	154
12.2 Configuring Static Multicast Forwarding	155
Filtering	158
13.1 Configure a Filtering Rule	158
Spanning Tree Protocol	160
14.1 STP/RSTP Overview	160
14.1.1 STP Terminology	160
14.1.2 How STP Works	161
14.1.3 STP Port States	161
14.1.4 Multiple RSTP	162
14.1.5 Multiple STP	162
14.2 Spanning Tree Protocol Status Screen	165
14.3 Spanning Tree Configuration	165
14.4 Configure Rapid Spanning Tree Protocol	166
14.5 Rapid Spanning Tree Protocol Status	167
14.6 Configure Multiple Rapid Spanning Tree Protocol	168
14.7 Multiple Rapid Spanning Tree Protocol Status	170
14.8 Configure Multiple Spanning Tree Protocol	171
14.9 Multiple Spanning Tree Protocol Status	173
Broadcast Storm Control	176
15.1 Broadcast Storm Control Setup	176
Mirroring	178
16.1 Port Mirroring Setup	178
Link Aggregation	180
17.1 Link Aggregation Overview	180
17.2 Dynamic Link Aggregation	180
17.2.1 Link Aggregation ID	181
17.3 Link Aggregation Status	181
17.4 Link Aggregation Setting	182
17.5 Link Aggregation Control Protocol	183
17.6 Static Trunking Example	184
Port Authentication	186
18.1 Port Authentication Overview	186
18.1.1 IEEE 802.1x Authentication	186
18.1.2 MAC Authentication	187
18.2 Port Authentication Configuration	188
18.2.1 Activate IEEE 802.1x Security	188
18.2.2 Activate MAC Authentication	189
MAC Limit	191
19.1 MAC Limit Overview	191
19.2 MAC Limit	191
19.2.1 Mac Limit: Port Security	191
19.2.2 MAC Limit: VLAN Security	193
Classifier	194
20.1 About the Classifier and QoS	194
20.2 Configuring the Classifier	194
20.3 Viewing and Editing Classifier Configuration	197
20.4 Classifier Example	199
Policy Rule	200
21.1 Policy Rules Overview	200
21.1.1 DiffServ	200
21.1.2 DSCP and Per-Hop Behavior	200
21.2 Configuring Policy Rules	200
21.3 Policy Example	204
Queuing Method	205
22.1 Queuing Method Overview	205
22.1.1 Strictly Priority Queuing	205
22.1.2 Weighted Fair Queuing	205
22.1.3 Weighted Round Robin Scheduling (WRR)	205
22.2 Configuring Queuing	206
VLAN Stacking	208
23.1 VLAN Stacking Overview	208
23.1.1 VLAN Stacking Example	208
23.2 VLAN Stacking Port Roles	209
23.3 VLAN Tag Format	210
23.3.1 Frame Format	210
23.4 Configuring VLAN Stacking	211
23.4.1 Port-based Q-in-Q	212
23.4.2 Selective Q-in-Q	214
23.4.3 Port-based InnerQ	215
Multicast	217
24.1 Multicast Overview	217
24.1.1 IP Multicast Addresses	217
24.1.2 IGMP Filtering	217
24.1.3 IGMP Snooping	217
24.1.4 IGMP Snooping and VLANs	218
24.1.5 IGMP Proxy	218
24.1.6 Multicast Listener Discovery	218
24.1.7 MLD Messages	218
24.2 Multicast Status	219
24.3 Multicast Setting	221
24.4 IGMP Snooping VLAN	223
24.5 IGMP Filtering Profile	224
24.6 MVR Overview	225
24.6.1 Types of MVR Ports	226
24.6.2 MVR Modes	226
24.6.3 How MVR Works	226
24.7 General MVR Configuration	227
24.8 MVR Group Configuration	229
24.8.1 MVR Configuration Example	230
Authentication and Accounting	233
25.1 Authentication, Authorization and Accounting	233
25.1.1 Local User Accounts	233
25.1.2 RADIUS and TACACS+	234
25.2 Authentication and Accounting Screens	234
25.2.1 RADIUS Server Setup	234
25.2.2 TACACS+ Server Setup	237
25.2.3 Authentication and Accounting Setup	239
25.2.4 Vendor Specific Attribute	241
25.3 Supported RADIUS Attributes	242
25.3.1 Attributes Used for Authentication	242
25.3.2 Attributes Used for Accounting	243
IP Source Guard	246
26.1 IP Source Guard Overview	246
26.1.1 DHCP Snooping Overview	246
26.1.2 ARP Inspection Overview	248
26.2 IP Source Guard	250
26.3 IP Source Guard Static Binding	250
26.4 DHCP Snooping	252
26.5 DHCP Snooping Configure	254
26.5.1 DHCP Snooping Port Configure	256
26.5.2 DHCP Snooping VLAN Configure	257
26.6 ARP Inspection Status	258
26.6.1 ARP Inspection VLAN Status	260
26.6.2 ARP Inspection Log Status	261
26.7 ARP Inspection Configure	262
26.7.1 ARP Inspection Port Configure	263
26.7.2 ARP Inspection VLAN Configure	265
Loop Guard	267
27.1 Loop Guard Overview	267
27.2 Loop Guard Setup	269
CFM	271
28.1 CFM Overview	271
28.1.1 How CFM Works	271
28.2 CFM MA	272
28.3 CFM MD	274
VLAN Mapping	275
29.1 VLAN Mapping Overview	275
29.1.1 VLAN Mapping Example	275
29.2 Enabling VLAN Mapping	276
29.3 Configuring VLAN Mapping	277
Layer 2 Protocol Tunneling	279
30.1 Layer 2 Protocol Tunneling Overview	279
30.1.1 Layer 2 Protocol Tunneling Mode	280
30.2 Configuring Layer 2 Protocol Tunneling	281
DoS Prevention	283
31.1 DoS Prevention Overview	283
31.2 Configuring DoS Prevention	283
PPPoE IA	285
32.1 PPPoE Intermediate Agent Overview	285
32.1.1 PPPoE Intermediate Agent Tag Format	285
32.1.2 Sub-Option Format	286
32.1.3 PPPoE IA Configuration Options	286
32.2 The PPPoE IA Status Screen	287
32.3 PPPoE IA Global Configuration	287
32.4 PPPoE IA VLAN Configuration	288
SFP Threshold	291
33.1 SFP Threshold Setup	291
33.1.1 SFP Status	292
Static Route	295
34.1 Static Routing Overview	295
34.2 Configuring Static Routing	296
Differentiated Services	298
35.1 DiffServ Overview	298
35.1.1 DSCP and Per-Hop Behavior	298
35.1.2 DiffServ Network Example	298
35.2 Two Rate Three Color Marker Traffic Policing	299
35.2.1 TRTCM-Color-blind Mode	300
35.2.2 TRTCM-Color-aware Mode	300
35.3 Activating DiffServ	300
35.3.1 Configuring 2-Rate 3 Color Marker Settings	301
35.4 DSCP-to-IEEE 802.1p Priority Settings	303
35.4.1 Configuring DSCP Settings	303
DHCP	305
36.1 DHCP Overview	305
36.1.1 DHCP Modes	305
36.1.2 DHCP Configuration Options	305
36.2 DHCP Status	305
36.3 DHCP Relay	306
36.3.1 DHCP Relay Agent Information	306
36.3.2 DHCP Relay Agent Information Format	306
36.3.3 Sub-Option Format	307
36.3.4 Configuring DHCP Global Relay	307
36.3.5 Global DHCP Relay Configuration Example	309
36.4 Configuring DHCP VLAN Settings	310
36.4.1 Example: DHCP Relay for Two VLANs	311
Maintenance	313
37.1 The Maintenance Screen	313
37.2 Firmware Upgrade	314
37.2.1 Dual Firmware Image	314
37.3 Restore a Configuration File	315
37.4 Backup a Configuration File	316
37.5 Load Factory Default	316
37.6 Save Configuration	317
37.7 Reboot System	317
37.8 FTP Command Line	317
37.8.1 Filename Conventions	317
37.8.2 FTP Command Line Procedure	318
37.8.3 GUI-based FTP Clients	319
37.8.4 FTP Restrictions	319
Access Control	320
38.1 Access Control Overview	320
38.2 The Access Control Main Screen	320
38.3 About SNMP	320
38.3.1 SNMP v3 and Security	321
38.3.2 Supported MIBs	322
38.3.3 SNMP Traps	322
38.3.4 Configuring SNMP	326
38.3.5 Configuring SNMP Trap Group	328
38.3.6 Setting Up Login Accounts	328
38.4 SSH Overview	330
38.5 How SSH works	330
38.6 SSH Implementation on the Switch	331
38.6.1 Requirements for Using SSH	331
38.7 Introduction to HTTPS	331
38.8 HTTPS Example	332
38.8.1 Internet Explorer Warning Messages	332
38.8.2 Mozilla Firefox Warning Messages	335
38.8.3 Netscape Navigator Warning Messages	336
38.8.4 The Main Screen	337
38.9 Service Port Access Control	338
38.10 Remote Management	339
Diagnostic	341
39.1 Diagnostic	341
Syslog	342
40.1 Syslog Overview	342
40.2 Syslog Setup	343
40.3 Syslog Server Setup	344
Loop Diagnostic	345
41.1 Dual-End Loop Test	345
41.2 Single-End Loop Test (SELT)	347
MAC Table	349
42.1 MAC Table Overview	349
42.2 Viewing the MAC Table	350
ARP Table	351
43.1 ARP Table Overview	351
43.1.1 How ARP Works	351
43.2 Viewing the ARP Table	351
Hardware Information	353
44.1 Hardware Information	353
CFM Action	354
45.1 CFM Action	354
IPv6 Cache	356
46.1 Overview	356
46.2 Neighbor Cache	357
46.3 Prefix List	358
46.4 Destination Cache	359
46.5 Route List	360
46.6 Default Router List	361
Troubleshooting	363
47.1 Power, Hardware Connections, and LEDs	363
47.2 Switch Access and Login	364
47.3 Switch Configuration	366
Product Specifications	367
Common Services	383
Legal Information	387

Match case Limit results 1 per page

VES1724-56 User’s Guide

233

HAPTER

Authentication and Accounting

This chapter describes how to configure authentication and accounting settings on the Switch.

25.1

Authentication, Authorization and Accounting

Authentication is the process of determining who a user is and validating access to the Switch. The

Switch can authenticate users who try to log in based on user accounts configured on the Switch

itself. The Switch can also use an external authentication server to authenticate a large number of

users

Authorization is the process of determining what a user is allowed to do. Different user accounts

may have higher or lower privilege levels associated with them. For example, user A may have the

right to create new login accounts on the Switch but user B cannot. The Switch can authorize users

based on user accounts configured on the Switch itself or it can use an external server to authorize

a large number of users.

Accounting is the process of recording what a user is doing. The Switch can use an external server

to track when users log in, log out, execute commands and so on. Accounting can also record

system related actions such as boot up and shut down times of the Switch.

The external servers that perform authentication, authorization and accounting functions are known

as AAA servers. The Switch supports RADIUS (Remote Authentication Dial-In User Service, see

Section 25.1.2 on page 234

) and TACACS+ (Terminal Access Controller Access-Control System

Plus, see

Section 25.1.2 on page 234

) as external authentication, authorization and accounting

servers.

Figure 137

AAA Server

25.1.1

Local User Accounts

By storing user profiles locally on the Switch, your Switch is able to authenticate and authorize

users without interacting with a network authentication server. However, there is a limit on the

number of users you may authenticate in this way (See

Chapter 37 on page 313

Client

Auth Server