Huawei SmartAX MA5603T Configuration Manual page 274

SmartAX MA5600T/MA5603T/MA5608T Multi-service
Access Module
Commissioning and Configuration Guide
huawei(config)#aaa
huawei(config-aaa)#authentication-scheme login-auth
huawei(config-aaa-authen-login-auth)#authentication-mode hwtacacs
huawei(config-aaa-authen-login-auth)#quit
Step 2 Configure the HWTACACS protocol.
Create HWTACACS server template named ma56t-login with HWTACACS server
10.10.66.66 as the primary authentication server, and HWTACACS server 10.10.66.67 as the
secondary authentication server.
huawei(config)#hwtacacs-server template ma56t-login
Create a new HWTACACS-server template
huawei(config-hwtacacs-ma56t-login)#hwtacacs-server authentication 10.10.66.66
1812
huawei(config-hwtacacs-ma56t-login)#hwtacacs-server authentication 10.10.66.67
1812 secondary
huawei(config-hwtacacs-ma56t-login)#quit
Step 3 Create a domain named isp1.
NOTE
l A domain is a group of users of the same type.
l In the user name format userid@domain-name (for example, huawei20041028@huawei.net), "userid"
indicates the user name for authentication and "domain-name" followed by "@" indicates the domain name.
l The domain name for user login cannot exceed 15 characters, and the other domain names cannot exceed
20 characters.
huawei(config)#aaa
huawei(config-aaa)#domain isp1
Info: Create a new domain
Step 4 Use the authentication scheme login-auth.
You can use an authentication scheme in a domain only after the authentication scheme is
created.
huawei(config-aaa-domain-isp1)#authentication-scheme login-auth
Step 5 Bind the HWTACACS server template ma56t-login to the user.
You can use an HWTACACS server template in a domain only after the HWTACACS server
template is created.
huawei(config-aaa-domain-isp1)#hwtacacs-server ma56t-login
----End
Result
l
l
Configuration File
huawei(config)#aaa
huawei(config-aaa)#authentication-scheme login-auth
Issue 01 (2014-04-30)
When the HWTACACS server is reachable, the management user can log in to the
MA5600T/MA5603T/MA5608T through SSH. After entering the user name and password
specified on the HWTACACS server, the management user can successfully log in to the
MA5600T/MA5603T/MA5608T.
When the HWTACACS server is unreachable, the management user cannot log in to the
MA5600T/MA5603T/MA5608T through SSH by entering the user name and password
specified on the HWTACACS server.
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
2 Basic Configurations
249