| The network element must be configured to restrict management access according to the privilege level the user has been granted. Authorization to add, modify, or delete security policies must require the highest privilege level which can be implemented by simply assigning privilege levels to administrators or via an Authentication, Authorization, and Accounting (AAA) solution.
The implementation of an AAA solution affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the network elements in conjunction with an authentication server, the administrators can easily add, modify, or delete accounts as well as add or remove command authorizations and privilege levels. The use of an authentication server provides the capability to assign network administrators and engineers to tiered groups that contain their associated or required privilege level. This requirement is applicable to network device management and is not applicable to the routing function. |
