华三IMC-EIA平台hwtacacs认证配置案例

IMC侧配置如下：

配置“授权场景条件”

添加“设备区域管理”

设置“区域名称”

设置“设备类型管理”

增加

设置“授权时段策略管理” 

增加，设置“授权时段策略名称”、“生效时间”、“失效时间”

设置“授权命令配置”-“shell profile配置”

设置“shell profile名称”-“授权级别”

设置“命令集配置”

设置“命令集名称”、“缺省授权方式”

配置“设备管理”

增加设备，设置“共享密钥”、“确认共享密钥”，绑定“设备区域”、“设备类型”

配置“授权管理”

绑定“设备区域”-“设备类型”-“授权时段”-“shell profile”-“授权命令集”

配置“用户设备分组”，设置“分组名称”-“授权策略”

设置“设备用户管理”-“所有设备用户”

设置“账号名”-“登陆密码”-“登陆密码确认”-“设备用户分组”-“用户的授权策略”

S5130 hwtacacs部署如下：

1、部署hwtacacs：

hwtacacs scheme shebeiguanli

 primary authentication 10.190.8.7

 primary authorization 10.190.8.7

 primary accounting 10.190.8.7

 key authentication cipher $c$3$0WXDzbOOS8r2sAxFiX4C8sfDbb7Guk2gANOWkYc=

 key authorization cipher $c$3$w5bCoTweLA7T2V5XfPWZRtsza6Q/1vsYCsADiII=

 key accounting cipher $c$3$1VzC/MZ/BOxD4k6jefDz68TRVWi9eD68/fit3G4=

 user-name-format without-domain

 nas-ip 10.190.0.184

2、配置domain:

domain tamdm

 authentication login hwtacacs-scheme shebeiguanli local

 authorization login hwtacacs-scheme shebeiguanli local

 accounting login hwtacacs-scheme shebeiguanli local

 authorization command hwtacacs-scheme shebeiguanli local

 accounting command hwtacacs-scheme shebeiguanli

3、启用默认domain:

domain default enable tamdm

4、查看hwtacacs显示信息：

dis hwtacacs scheme

Total 1 HWTACACS schemes

------------------------------------------------------------------

HWTACACS Scheme Name  : shebeiguanli

  Index : 0

  Primary Auth Server:

    Host name: Not Configured

    IP  : 10.190.8.7      Port: 49     State: Active

    VPN Instance: Not configured                

    Single-connection: Disabled

  Primary Author Server:

    Host name: Not Configured

    IP  : 10.190.8.7      Port: 49     State: Active

    VPN Instance: Not configured                

    Single-connection: Disabled

  Primary Acct Server:

    Host name: Not Configured

    IP  : 10.190.8.7      Port: 49     State: Active

    VPN Instance: Not configured                

    Single-connection: Disabled

  VPN Instance                          : Not configured

  NAS IP Address                        : 10.190.0.184

  Server Quiet Period(minutes)          : 5

  Realtime Accounting Interval(minutes) : 12

  Stop-accounting packets buffering     : Enabled

    Retransmission times                : 100

  Response Timeout Interval(seconds)    : 5

  Username Format                       : without-domain

  Data flow unit                        : Byte

  Packet unit                           : one

5、查看domain显示信息：

dis domain tamdm

Domain: tamdm

  State: Active

  Login   authentication scheme:  HWTACACS=shebeiguanli, Local

  Login   authorization  scheme:  HWTACACS=shebeiguanli, Local

  Login   accounting     scheme:  HWTACACS=shebeiguanli, Local

  Command authorization  scheme:  HWTACACS=shebeiguanli, Local

  Command accounting     scheme:  HWTACACS=shebeiguanli

  Default authentication scheme:  Local

  Default authorization  scheme:  Local

  Default accounting     scheme:  Local

  Accounting start failure action: Online

  Accounting update failure action: Online

  Accounting quota out policy: Offline

  Service type: HSI

  Session time: Exclude idle time

  Dual-stack accounting method: Merge

  Authorization attributes:

    Idle cut: Disabled

    IGMP access limit: 4

    MLD access limit: 4

 至此，S5130 hwtacacs典型组网配置案例已完成！