Network Security and Services · Topic 2 of 4
AAA Principles and Configuration
Learn AAA authentication, authorization and accounting, local, RADIUS and HWTACACS modes, domains, schemes and local users on Huawei VRP for HCIA.
- 5 min
- Authentication is who you are, authorization is what you may do, accounting is what you did.
- Authentication modes: local, RADIUS, HWTACACS, none. Accounting has no local mode.
- RADIUS uses UDP 1812 and 1813 and combines authentication with authorization. HWTACACS uses TCP 49 and separates them.
What it is
AAA is a framework for controlling who uses the network or a device and what they do there:
- Authentication checks who the user is.
- Authorization decides what the user may do.
- Accounting records what the user did, such as login time and duration.
On Huawei devices, AAA controls administrator logins through Telnet, SSH, FTP and the console, and network access for users. The device acts as the AAA client (NAS), and the decision is made locally or by a remote server.
How it works
Authentication, authorization and accounting modes
| Function | Modes available on VRP |
|---|---|
| Authentication | Local, RADIUS, HWTACACS, none |
| Authorization | Local, RADIUS (given together with authentication), HWTACACS, if-authenticated, none |
| Accounting | RADIUS, HWTACACS, none |
Modes can be listed in order as a fallback. For example, authentication-mode radius local tries RADIUS first and uses the local user database only if the RADIUS server does not respond. A user rejected by RADIUS is not then tried locally.
Local and remote AAA
Local AAA stores users and passwords on the device. It is simple and works without a server, but every device needs its own user list. It suits small networks and as a backup.
Remote AAA stores users centrally on a server, so one change applies to every device.
| Protocol | Transport | Notes |
|---|---|---|
| RADIUS | UDP, port 1812 for authentication and 1813 for accounting | Open standard, combines authentication and authorization, encrypts only the password |
| HWTACACS | TCP port 49 | Huawei protocol based on TACACS+, separates the three functions, encrypts the whole packet body, supports command authorization |
Domains and schemes
AAA on VRP is organized around domains. A domain links a group of users to an authentication scheme, an authorization scheme, an accounting scheme and, for remote AAA, a server template.
The user's domain comes from the user name. A user who logs in as admin@huawei belongs to domain huawei. A user name with no domain part goes to a default domain. VRP has two built in domains, default for access users and default_admin for administrators.
User privilege levels
A local user gets a level from 0 to 15. Commands are grouped into four levels:
| Command level | Name | Example commands |
|---|---|---|
| 0 | Visit | ping, tracert, telnet |
| 1 | Monitoring | display commands |
| 2 | Configuration | Service configuration commands |
| 3 | Management | System management, such as file operations and user management |
A user can run commands at or below their own level. User levels 3 to 15 all reach management commands, and level 15 is the usual administrator level.
Configuration example: local AAA for Telnet
[R1] telnet server enable
[R1] aaa
[R1-aaa] local-user admin password irreversible-cipher Huawei@123
[R1-aaa] local-user admin service-type telnet
[R1-aaa] local-user admin privilege level 15
[R1-aaa] quit
[R1] user-interface vty 0 4
[R1-ui-vty0-4] authentication-mode aaa
[R1-ui-vty0-4] protocol inbound telnetThe local user is created in the aaa view, given a password, allowed one or more service types (such as telnet, ssh, ftp, terminal) and given a level. The VTY lines must use authentication-mode aaa, or the local user database is never asked.
Configuration example: a domain with RADIUS and local fallback
[R1] radius-server template rd1
[R1-radius-rd1] radius-server authentication 10.1.1.100 1812
[R1-radius-rd1] radius-server accounting 10.1.1.100 1813
[R1-radius-rd1] radius-server shared-key cipher Huawei@123
[R1-radius-rd1] quit
[R1] aaa
[R1-aaa] authentication-scheme auth1
[R1-aaa-authen-auth1] authentication-mode radius local
[R1-aaa-authen-auth1] quit
[R1-aaa] domain huawei
[R1-aaa-domain-huawei] authentication-scheme auth1
[R1-aaa-domain-huawei] radius-server rd1Users who log in as name@huawei are now checked by the RADIUS server at 10.1.1.100. The shared key must match on the device and on the server. Verify local users with display local-user and live sessions with display access-user.
A worked example
An administrator creates local user ops with service-type ssh, but a Telnet login as ops fails at the password prompt. The password is correct.
The user is not allowed the Telnet service. Adding local-user ops service-type telnet ssh allows both, and the login works.
How the exam asks about this
- "Which AAA function decides which commands a logged in user can run?" → Authorization.
- "Which protocol uses TCP port 49 and can authorize individual commands?" → HWTACACS.
- "A user logs in as
tom@sales. Which domain is used?" → Domainsales, taken from the part after the @.
What to remember for the exam
- Authentication is who you are, authorization is what you may do, accounting is what you did.
- Authentication modes: local, RADIUS, HWTACACS, none. Accounting has no local mode.
- RADIUS uses UDP 1812 and 1813 and combines authentication with authorization. HWTACACS uses TCP 49 and separates them.
- Users belong to domains, and each domain points to authentication, authorization and accounting schemes.
- VTY lines need
authentication-mode aaa, and the local user needs the rightservice-typeand level.
In authentication-mode radius local, the local database is used only when the RADIUS server gives no answer. A user rejected by the server is not retried locally.
Common mistakes
Forgetting the service type. A local user with a correct password still cannot log in through a service it is not allowed. Check service-type first.
Treating RADIUS and HWTACACS as the same. RADIUS is UDP and encrypts only the password. HWTACACS is TCP and encrypts the whole body.
Leaving the domain off the user name. A user name without @domain falls into a default domain, which may use a different scheme from the one you configured.
Check yourself
Which AAA function records how long a user stayed connected?
Accounting. It records session data such as start time, duration and traffic.
What user privilege level is normally given to a full administrator?
Level 15, which reaches all management level commands.
Which VTY command makes Telnet logins use the AAA local user database?
authentication-mode aaa, entered inuser-interface vty 0 4.
Topic 2 of 4 in Network Security and Services
Test yourself on Network Security and Services
The full Huawei HCIA-Datacom H12-811 question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.