AAA with Local, RADIUS, and HWTACACS

AAA with Local, RADIUS, and HWTACACS

Quick Answer: AAA = Authentication, Authorization, Accounting. On Huawei devices, start with local-user accounts (password, privilege level, service-type). For centralized control, use RADIUS (UDP-based, password-focused encryption) or HWTACACS (Huawei TACACS+ family: TCP, encrypts the entire body, clean separation of authZ). HCIA tests definitions, local-user attributes, and protocol comparisons more than every RADIUS attribute ID.

Controlling who can log into network devices—and what they can run after login—is as important as filtering data-plane packets with ACLs. AAA is the framework that answers identity questions consistently across console, Telnet, SSH, and sometimes network access services. This section ties local configuration to centralized servers you will see named on H12-811.

The three A’s, without slogans only

Exam trap: mixing the words. “Defines what an authenticated user may do” is authorization, not authentication. “Records session start/stop” is accounting. “Validates credentials” is authentication.

Authentication can succeed while authorization still blocks configuration—exactly the symptom when a user has a valid password but privilege level is too low for system-view tasks.

Local AAA: users on the box

Local users live in the device configuration under the aaa view. Teaching-pattern commands:

[Huawei] aaa
[Huawei-aaa] local-user netadmin password irreversible-cipher ********
[Huawei-aaa] local-user netadmin privilege level 15
[Huawei-aaa] local-user netadmin service-type terminal ssh
[Huawei-aaa] local-user auditor password irreversible-cipher ********
[Huawei-aaa] local-user auditor privilege level 1
[Huawei-aaa] local-user auditor service-type terminal ssh

(Password encoding keywords vary by software train—irreversible-cipher is common in modern materials. Learn the attributes.)

Privilege level

Privilege is authorization after authentication. A level-1 user may open an SSH session and run many display commands yet fail to change OSPF or ACLs. That is working as designed, not a mysterious VRP bug.

service-type

service-type lists which access methods may use the account:

If an account has service-type telnet only, SSH login fails even with the correct password. Conversely, omitting terminal can block console use of that user depending on authentication mode. Always align service-type with how the engineer will connect.

When local AAA is enough

Local databases do not scale: twenty routers with the same local password that never rotates is an operational and security problem. That motivates RADIUS/HWTACACS.

Centralized AAA: why leave the box

Centralized servers give one place to create, disable, and audit admin accounts. Benefits HCIA expects you to articulate:

• Consistent credentials across many devices
• Faster offboarding when staff leave
• Stronger accounting and change tracking
• Optional separation of authentication and authorization policy

Devices become AAA clients. They forward authentication requests to a server group and enforce the result (accept/reject, privilege attributes, etc.).

RADIUS essentials

RADIUS (Remote Authentication Dial-In User Service) is widely used for both network access (802.1X, VPN) and device administration.

On Huawei, you define a RADIUS server template (server IP, shared key, ports) and reference it from an AAA authentication scheme. Exact command trees vary by version; conceptual chain is:

1. Reachability to the RADIUS server (routing, firewall allowing UDP 1812/1813).
2. Matching shared key on device and server.
3. AAA authentication scheme using RADIUS.
4. Domain or user-interface / login configuration that selects that scheme.
5. Test login; watch server logs if reject occurs.

Shared-key mismatch is a top real-world failure mode and a fair exam distractor explanation (“server unreachable” vs “key wrong” both yield auth failure from the client’s point of view).

HWTACACS essentials

HWTACACS is Huawei’s TACACS+ family implementation for device management AAA. Compare it carefully with RADIUS—this is a high-value table for H12-811.

Exam trap: “Which protocol encrypts the entire authentication packet body and uses TCP?” → HWTACACS, not RADIUS. “Which uses UDP 1812 for authentication?” → RADIUS.

HWTACACS configuration conceptual chain mirrors RADIUS: server host, shared key, scheme binding, domain/login method, test. TCP’s connection-oriented nature can make firewall troubleshooting slightly different (stateful TCP 49 vs UDP 1812).

Schemes, domains, and method lists (conceptual)

Huawei AAA separates what protocol to use from when to use it:

A common resilient design: authenticate RADIUS first, fall back to local if the server is unreachable—so a WAN outage does not lock every engineer out. Exam stems may ask what happens if only RADIUS is configured and the server is down: remote logins fail unless a local fallback or console break-glass exists.

Local vs RADIUS vs HWTACACS decision table

You can run mixed designs: local emergency user + centralized primary authentication.

Tying AAA back to remote management

From earlier VRP basics, remote SSH needs more than a user object:

1. Device IP reachability
2. SSH/STelnet server enabled and keys present
3. VTY user-interface authentication mode set for AAA/scheme as required
4. User permitted by service-type ssh
5. Privilege high enough for the task
6. Optional ACL on VTY limiting source addresses

AAA failures hide inside that stack. Systematic isolation:

Security hygiene at HCIA level

• Prefer SSH over Telnet for device admin.
• Do not reuse level-15 passwords across all gear without a vault/process.
• Disable unused service-types.
• Keep a documented break-glass local account with controlled storage.
• Align accounting so privileged changes are attributable—especially when multiple engineers share responsibility.

Exam traps

• Swapping definitions of authentication, authorization, and accounting.
• Claiming RADIUS encrypts the entire packet like HWTACACS.
• Assigning TCP 49 to RADIUS or UDP 1812 to HWTACACS.
• Creating a local user without service-type ssh then troubleshooting routing for an hour.
• Confusing privilege level with VLAN ID, ACL number, or OSPF process ID.
• Assuming centralized AAA removes the need for any local emergency access design.

Integrated mini-scenario

Company policy: all SSH logins to campus routers use HWTACACS; if the HWTACACS server is down, a local user breakglass level 15 with service-type ssh terminal may authenticate. RADIUS remains used for 802.1X on switches, not for these router admin logins.

HCIA-style questions drawn from that story:

• Which protocol carries router admin auth with full-body encryption? HWTACACS.
• What local attributes must breakglass have? Password, level 15, service-type including ssh.
• If HWTACACS is up but the user is only authorized for level 1, can they rewrite ACLs? No—authorization limits them.

What to memorize for exam day

1. Expand AAA correctly in one sentence each.
2. Local-user triad: password, privilege, service-type.
3. RADIUS: UDP, 1812/1813, password encryption scope.
4. HWTACACS: TCP, full-body encryption, strong admin AuthZ/accounting story.
5. Centralized AAA needs reachability, shared key, and scheme binding—not only a username on the server.

Combine this chapter with ACLs: data-plane traffic-filter controls packets; AAA controls who drives the CLI that writes those filters. Both are network services weighted topics on HCIA-Datacom—treat them as paired skills for secure operations.