AAA Architecture for Unified Configuration Management in Large-Scale Network

Unified configuration management of network devices in large-scale environment is an important issue. As a traditional method, password authentication by router can not verify the administrators' identities. In other words, someone who actually is not an administrator, can also access the router if he knows password. In this paper, we present a new policy-based AAA architecture that uses VPN and certificate-based authentication. By implementing the architecture, administrators can access authorized routers only and execute authorized commands. Single Sign-On mechanism is used to simplify authentication process. Moreover, the actions of administrators can be logged for accounting. Finally, we implement the architecture in Tianjin Education Metropolitan Area Network.