Configuring a Domain
Context
The created authentication and authorization schemes are in effect only when they are applied to a domain. When local authentication and authorization are used, the default accounting mode is non-accounting.
Procedure
- Run system-view
The system view is displayed.
- Run aaa
The AAA view is displayed.
- Run domain domain-name
A domain is created and the domain view is displayed, or the view of an existing domain is displayed.
Two default domains named default and default_admin exists on the device. The two domains can be modified but not deleted.
- If an entered user name does not contain the domain name, the user is authenticated in the default domain. You need to run the default-domain admin domain-name command to specify the default global domain.
- If an entered user name contains the domain name, the domain-name parameter must be correctly specified.
- Run authentication-scheme authentication-scheme-name
An authentication scheme is applied to the domain.
By default, the authentication scheme named default is applied to a domain.
- Run authorization-scheme authorization-scheme-name
An authorization scheme is applied to the domain.
By default, the authorization scheme named default is applied to a domain, and the default authorization mode is local authorization.
- (Optional) Run block
The domain state is set to block.
When a domain is in the blocking state, users in this domain cannot log in. By default, a created domain is in the active state.
- (Optional) Run service-type { dot1x | ftp | http | snmp | ssh | telnet | terminal } *
The access type is specified for users in the domain.
By default, a local user can use any access type.
- (Optional) Run access-limit max-number
The maximum number of access users is set for the domain.
By default, the number of access users is not limited.
- (Optional) Run adminuser-priority level
The default user level is set for administrators in the domain.
By default, no default user level is set for administrators in an AAA domain.
- Run quit
You exit the domain view.
- (Optional) Run default-domain admin domain-name
A global default domain is specified for administrators.
The global default domain for administrators is default_admin.
- (Optional) Run domain-name-delimiter delimiter
The domain name delimiter is set.
The default domain name delimiter is @.
- (Optional) Run domainname-parse-direction { left-to-right | right-to-left }
The direction in which the domain name is parsed is specified.
By default, a domain name is parsed from left to right.
- (Optional) Run domain-location { after-delimiter | before-delimiter }
The position of the domain name is specified.
By default, the domain name is placed after the domain name delimiter.
- Run commit
The configuration is committed.
