AAA基础配置

组网需求

为组网安全，经常会使用AAA技术，本次以CE12800交换机+Window为例，实现AAA本地认证登录

组网拓扑

实验步骤

1. 配置接口IP，连通终端
2. 进入AAA视图
3. 配置用户名密码
4. 配置账户权限
5. 配置登入方式
6. 进入vty视图
7. 配置认证模式AAA

测试结果

查看用户在线情况

[HUAWEI]display aaa offline-record 
---------------------------------------------------------------------------
Offline record switch          : Enable
---------------------------------------------------------------------------
User name                      : luochen
Domain name                    : default_admin
User access type               : Telnet
User IP address                : 1.1.1.2
User ID                        : 4
User authen state              : Success
User author state              : Success
User login time                : 2025-06-01 10:15:32
User offline time              : 2025-06-01 10:17:06
User offline reason            : Client disconnectUser name                      : luochen
Domain name                    : default_admin
User access type               : Telnet
User IP address                : 1.1.1.2
User ID                        : 3
User authen state              : Success
User author state              : Success
User login time                : 2025-06-01 10:14:03
User offline time              : 2025-06-01 10:14:26
User offline reason            : Client disconnect
---------------------------------------------------------------------------
Total 2, 2 printed

查看domain域信息

• default_admin：管理用户的缺省域
• default：普通用户的缺省域

[HUAWEI]display aaa domain default_admin
--------------------------------------------------------------------------------
Domain-name                 : default_admin
Domain-state                : Active
Authentication-scheme-name  : default
Authorization-scheme-name   : default
Accounting-scheme-name      : default
User-access-limit           : 283648
Online-number               : 0
AdminUser-priority          : -
HWTACACS-server-template    : -
RADIUS-server-group         : -
--------------------------------------------------------------------------------
[HUAWEI]display aaa domain default      
--------------------------------------------------------------------------------
Domain-name                 : default
Domain-state                : Active
Authentication-scheme-name  : default
Authorization-scheme-name   : default
Accounting-scheme-name      : default
User-access-limit           : 283648
Online-number               : 0
AdminUser-priority          : -
HWTACACS-server-template    : -
RADIUS-server-group         : -
--------------------------------------------------------------------------------

配置文件

认证方案+domain域均为默认配置

#
aaalocal-user luochen password irreversible-cipher Huawei@123local-user luochen service-type telnetlocal-user luochen level 3
#
interface GE1/0/0undo portswitchundo shutdownip address 1.1.1.1 255.255.255.0
#
user-interface vty 0 4authentication-mode aaa
#