AAA Scheme

You can add, modify, and delete an authentication scheme, authorization scheme, or accounting scheme.

Authentication, Authorization, and Accounting are three independent service processes.

In the authentication process, a device authenticates the user name, password, or user information of an access request or a service request. The device, however, neither delivers authorization information to the user nor triggers the accounting process. In AAA, a device can adopt only authentication.
In the authorization process, a device sends authorization requests to the authorization server. After users pass authorization, the device sends authorization information to users. If the authorization scheme is none, users do not need to be authorized. In this case, users passing authentication have the default authority granted by the system.
In the accounting process, a device sends accounting-start packets, accounting-update packets, or accounting-stop packets to the accounting server. In AAA, an accounting scheme is optional.

Create an authentication scheme.

NOTE:

You can create an authentication scheme, authorization scheme, or accounting scheme. Here the authentication scheme is used as an example.

Choose Security > AAA > AAA Scheme in the navigation tree to open the AAA Scheme page.

Click Create to open the Create Authentication Scheme page.

Table 1 describes the parameters on the Create Authentication Scheme page.

**Table 1** Create Authentication Scheme
Item	Description
Authentication scheme name	Indicates the name of an authentication scheme. This parameter is mandatory.
Mode	Indicates the authentication mode. There are four authentication modes for you to select. NOTE: The options are none, hwtacacs, radius, and local. You can use the combination of authentication modes. If the authentication mode is none, you cannot configure an authentication scheme. You cannot set the same authentication modes; otherwise, you cannot create an authentication scheme.