background image
Interface Types 373
Authorization
Authorization enables the administrator to control authorization on a one-time, per-service, per-
user list, per-group, or per-protocol basis. AAA lets the administrator create attributes that
describe the functions that the user is allowed to use.
AAA authorization works by assembling a set of attributes that describe what the user is
authorized to perform. These attributes are compared to the information contained in a database
for a given user and the result is returned to AAA to determine the user's actual capabilities and
restrictions. This requires that the database be in constant communication with the AAA server
during the connection to the RAS device.
Accounting
Accounting enables the administrator to collect information such as start and stop times for user
access, executed commands, traffic statistics, and resource usage and then store that
information in the RDBMS. In other words, accounting enables the tracking of service and
resources that are "consumed" by the user. The key point to accounting is the capability of the
administrator to proactively track and predict service and resource usage. This information can
then be used for client billing, internal billing, network management, or audit trails.
Interface Types
An understanding of the communication method on each port or port definition is important to
understanding and performing a successful configuration of AAA.
Character mode is used on the TTY, VTY, AUX, and CON ports. These are the control ports on
the router. On the other hand, packet mode is used on the async, group-async, BRI, PRI, serial,
dialer profiles, and dialer rotaries. These are the communication ports on the router.
The concept of control versus communication is a fine distinction. The use of the term control
indicates a character communication connection that enables control or configuration of the
router. The term communication indicates that the port is being used to access another source
other than the router.
Control ports are ports in which router configuration would normally take place. Character
mode sends keystrokes to the router through the TTY, VTY, AUX and CON ports for
configuration or query commands.
Communication ports are ports in which communication to another device occurs or where
traffic is passing through the router to another device. These ports are WAN ports. Packet mode
uses interface mode or a link protocol session to communicate with a device other than the
router. The defined interfaces on the router are async, group-async, BRI, PRI, serial, dialer
profiles, and dialer rotaries. Interfaces become important to the configuration of AAA. Each of
the authentications and authorizations is tied to one of the interfaces.