AAA系统的简称：

认证(Authentication)：验证用户的身份与可使用的网络服务；

授权：依据认证结果开放网络服务给用户；

AAA-----身份验证(Authentication)、授权 (Authorization)和统计 (Accounting)Cisco开发的一个提供网络安全的系统。参见authentication。authorization和accounting

实验目的：实现dhcp动态获取地址 和telnet交换机  需要AAA认证

实验拓扑：

实验设备：华为s2000交换机    h3c防火墙

实验过程：

服务器端配置：

交换机配置：dis cu

#

sysname SW1

#

dot1x

dot1x authentication-method pap

#

radius scheme system

radius scheme xxx

server-type standard

primary authentication 192.168.30.1

accounting optional

key authentication 123456

user-name-format without-domain

#

domain system

domain test

scheme radius-scheme xxx

access-limit enable 10

accounting optional

#

vlan 1

#

vlan 10

#

vlan 20

#

vlan 30

#

interface Vlan-interface1

ip address 192.168.1.24 255.255.255.0

#

interface Ethernet1/0/10

port access vlan 10

dot1x

#

interface Ethernet1/0/20

port access vlan 20

dot1x

#

interface Ethernet1/0/23

port access vlan 30

#

interface Ethernet1/0/24

port link-type trunk

port trunk permit vlan all

#

interface NULL0

#

ip route-static 0.0.0.0 0.0.0.0 192.168.1.1 preference 60

#

user-interface aux 0

user-interface vty 0 4

authentication-mode scheme

#

return

防火墙配置：

dis cu

#

sysname R1

#

firewall packet-filter enable

firewall packet-filter default permit

#

undo insulate

#

firewall statistic system enable

#

radius scheme system

server-type extended

#

domain system

#

interface Aux0

async mode flow

#

interface Ethernet0/0

ip address 192.168.1.1 255.255.255.0

dhcp select relay

#

interface Ethernet0/0.1

ip address 192.168.10.254 255.255.255.0

ip relay address 192.168.30.1

dhcp select relay

vlan-type dot1q vid 10

#

interface Ethernet0/0.2

ip address 192.168.20.254 255.255.255.0

ip relay address 192.168.30.1

dhcp select relay

vlan-type dot1q vid 20

#

interface Ethernet0/0.3

ip address 192.168.30.254 255.255.255.0

dhcp select relay

vlan-type dot1q vid 30

#

interface Ethernet0/4

dhcp select relay

#

interface Encrypt1/0

#

interface NULL0

#

firewall zone local

set priority 100

#

firewall zone trust

add interface Ethernet0/0

add interface Ethernet0/0.1

add interface Ethernet0/0.2

add interface Ethernet0/0.3

set priority 85

#

firewall zone untrust

set priority 5

#

firewall zone DMZ

set priority 50

#

user-interface con 0

user-interface aux 0

user-interface vty 0 4

#

return

实验验证：