18Tasks at a glance(Required.) Perform at least one of the following tasks to configure local users or AAA schemes:• Configuring local users• Configuring RADIUS schemes• Configuring HWTACACS schemes• Configuring LDAP schemes(Required.) Configure AAA methods for ISP domains:1. (Required.) Creating an ISP domain2. (Optional.) Configuring ISP domain status3. (Required.) Perform at least one of the following tasks to configure AAA authentication, authorization, andaccounting methods for the ISP domain:{ Configuring authentication methods for an ISP domain{ Configuring authorization methods for an ISP domain{ Configuring accounting methods for an ISP domain(Optional.) Enabling the session-control featureConfiguring AAA schemesThis section includes information on configuring local users, RADIUS schemes, HWTACACS schemes,and LDAP schemes.Configuring local usersTo implement local authentication, authorization, and accounting, create local users and configure userattributes on the device. The local users and attributes are stored in the local user database on the device.A local user is uniquely identified by the combination of a username and a user type. Local users areclassified into the following types:• Device management user—User who logs in to the device for device management.• Network access user—User who accesses network resources through the device.Configurable local user attributes are:• Service type—Services that the user can use. Local authentication checks the service types of a localuser. If none of the service types is available, the user cannot pass authentication.Service types include FTP, LAN access, SSH, Telnet, and terminal.• User state—Whether or not a local user can request network services. There are two user states:active and blocked. A user in active state can request network services, but a user in blocked statecannot.• User group—Each local user belongs to a local user group and bears all attributes of the group,such as the password control attributes and authorization attributes. For more information aboutlocal user group, see "Configuring user group attributes."• Binding attributes—Binding attributes are used for controlling the scope of users. They are checkedduring local authentication of a user. If the attributes of a user do not match the binding attributesconfigured for the local user account, the user cannot pass authentication. Binding attributesinclude IP address, access port, MAC address, and native VLAN. For support and usageinformation about binding attributes, see "Configuring local user attributes."
