Zyxel MES-3528 [200/354] Client aaa server

Chapter 24 AAA

MES-3528 User’s Guide

200

24.1.2 on page 200) as external authentication, authorization and accounting

servers.

Figure 108 AAA Server

24.1.1 Local User Accounts

By storing user profiles locally on the Switch, your Switch is able to authenticate

and authorize users without interacting with a network AAA server. However,

there is a limit on the number of users you may authenticate in this way (See

Chapter 31 on page 267).

24.1.2 RADIUS and TACACS+

RADIUS and TACACS+ are security protocols used to authenticate users by means

of an external server instead of (or in addition to) an internal device user database

that is limited to the memory capacity of the device. In essence, RADIUS and

TACACS+ authentication both allow you to validate an unlimited number of users

from a central location.

The following table describes some key differences between RADIUS and

TACACS+.

24.2 AAA Screens

The AAA screens allow you to enable authentication, authorization, accounting or

all of them on the Switch. First, configure your authentication and accounting

server settings (RADIUS, TACACS+ or both) and then set up the authentication

priority, activate authorization and configure accounting settings.

Client

AAA Server

Table 57 RADIUS vs. TACACS+

RADIUS TACACS+

Transport

Protocol

UDP (User Datagram Protocol) TCP (Transmission Control Protocol)

Encryption Encrypts the password sent for

authentication.

All communication between the client

(the Switch) and the TACACS server

is encrypted.