Firewall User Management Technologies · Topic 1 of 2

AAA Principles

Learn AAA authentication, authorization and accounting, local, RADIUS and HWTACACS schemes, domains and a basic aaa setup on Huawei firewalls for H12-711.

4 min
Includes a diagram

In a nutshell

AAA is authentication (who), authorization (what may be done) and accounting (what was done).
Authentication modes include local, RADIUS, HWTACACS and none; the firewall can also use AD and LDAP servers.
RADIUS uses UDP 1812 and 1813, encrypts only the password and combines authentication with authorization.

What it is

AAA stands for Authentication, Authorization and Accounting. It is the framework a network device uses to decide who a user is, what the user may do, and what the user did.

The device that users connect to, such as a USG firewall, acts as the AAA client, also called the NAS (network access server). It checks users against its own local database or asks a central AAA server.

How it works

The three functions

Function	Question it answers	Example
Authentication	Who are you?	Checking a user name and password
Authorization	What may you do?	Granting an administrator level, or which resources a user may reach
Accounting	What did you do?	Recording login time, duration and traffic

Authentication comes first, authorization follows, and accounting runs for the whole session.

Schemes and modes

Each function is configured as a scheme that lists the modes to use.

Function	Common modes
Authentication	Local, RADIUS, HWTACACS, none; a firewall also supports servers such as AD and LDAP
Authorization	Local, HWTACACS, if authenticated, none; with RADIUS, authorization comes with authentication
Accounting	RADIUS, HWTACACS, none

Local mode checks users stored on the device itself. It is simple and needs no server, but every device holds its own copy, so it suits small networks and backup logins.

Remote modes use a server, so accounts are managed in one place for many devices. A scheme can list a remote mode and then local, so local accounts still work if the server is unreachable.

RADIUS and HWTACACS

RADIUS authentication: a user sends a user name and password to the firewall, which acts as the RADIUS client and talks to the RADIUS server over UDP 1812 for authentication and UDP 1813 for accounting, using a shared key.

Item	RADIUS	HWTACACS
Transport	UDP	TCP
Ports	1812 authentication, 1813 accounting	49
Encryption	Only the password field	The whole packet body
Authentication and authorization	Combined in one exchange	Separate, so each can use a different server
Command authorization	Not supported	Supported, each command can be checked
Typical use	Network access users	Device administrators

RADIUS is an open standard. HWTACACS is Huawei's enhanced protocol based on TACACS, and it is similar in principle to TACACS+.

In RADIUS, the client and server share a key. The client sends an Access-Request, and the server answers with Access-Accept, Access-Reject or Access-Challenge.

Domains

A domain groups users and the schemes that apply to them. A user name such as user1@sales puts the user in the domain sales.

A user who enters no domain belongs to the default domain. Different domains can use different servers, so one firewall can serve several departments or customers.

A basic aaa configuration

aaa
 authentication-scheme admin_auth
  authentication-mode radius local

This scheme tries the RADIUS server first and falls back to the local user database only if the server does not respond. A user that RADIUS rejects is not retried locally.

A worked example

A company has twenty firewalls and routers. Each engineer must log in with a personal account, every command must be checked against the engineer's role, and the commands must be recorded.

The engineer picks HWTACACS, because it separates authorization from authentication and supports command authorization and accounting. A local administrator account stays on each device, with local as the fallback mode for when the server is down.

How the exam asks about this

"Which AAA function records the time a user stayed online?" -> Accounting.
"Which protocol uses TCP port 49 and encrypts the entire packet body?" -> HWTACACS.
"Which RADIUS port is used for accounting by default?" -> UDP 1813.

What to remember for the exam

AAA is authentication (who), authorization (what may be done) and accounting (what was done).
Authentication modes include local, RADIUS, HWTACACS and none; the firewall can also use AD and LDAP servers.
RADIUS uses UDP 1812 and 1813, encrypts only the password and combines authentication with authorization.
HWTACACS uses TCP 49, encrypts the whole body, separates the three functions and supports command authorization.
Users without a domain in the name belong to the default domain.

Watch out

A fallback to local is used only when the remote server does not answer. If the server answers with a reject, the user is rejected and local accounts are not checked.

Common mistakes

Mixing up authentication and authorization. Checking the password is authentication; deciding the level or resources after login is authorization.

Giving RADIUS command authorization. RADIUS has no per-command authorization; that is a reason to choose HWTACACS for administrators.

Saying RADIUS encrypts the whole packet. Only the password field is hidden with the shared key; the rest of the RADIUS packet travels in clear text.

Check yourself

Why would a scheme list radius local instead of only radius?
So that local accounts still work when the RADIUS server is unreachable, while normal logins use the central server.
Which protocol separates authentication, authorization and accounting?
HWTACACS, which runs over TCP port 49 and can authorize each command.
Which domain does a user who logs in as alice belong to?
The default domain, because the user name contains no domain part.

Topic 1 of 2 in Firewall User Management Technologies

Test yourself on Firewall User Management Technologies

The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.

Get Full Access Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.