The domain command creates a domain and enters the domain view; alternatively, you can enter the view of an existing domain.
The undo domain command deletes a domain from the device.
By default, there are three default domains on the device. The default domain cannot be deleted but modified.
| Parameter | Description | Value |
|---|---|---|
| domain-name |
Specifies the name of a domain. |
The value is a string of 1 to 64 case-insensitive characters,.The domain name does not support *, ?, ',or " characters and cannot be set to - or --. An AAA scheme is selected based on the domain field in the user name username@domain input by a user. When the user name input by a user does not contain @domain, if the user is a management user (user using Telnet, FTP, SSH, or terminal access), the system considers that the user goes online through the domain named default_admin by default; if the user is not a management user, the system considers that the user goes online through the domain named default1 by default. |
Usage Scenario
The device can manage users through domains. A domain is the minimum user management unit. A domain name can be an ISP name or the name of a service provided by an ISP. A domain can use the default authorization attribute, and be configured with a RADIUS template and authentication and accounting schemes.
Prerequisites
To perform AAA for access users, you need to apply the authentication schemes, authorization schemes, and accounting schemes in the domain view. Therefore, authentication, authorization, and accounting schemes must be configured in the AAA view in advance.
Precautions
The default_admin domain is used for administrators such as the administrators who log in using SSH, Telnet, FTP, and terminals. By default, local authentication is performed for users in the default_admin domain.
When the user name of an administrator does not carry the domain name or carries a nonexistent domain name, the device adds the administrator to the default domain.
The priority of the default authorization information configured in the domain is lower than that of the authorization information on the AAA server (remote RADIUS server or local authentication and accounting server). That is, when authorization information is configured both in the domain and on the AAA server, the user uses only the authorization information on the AAA server. When the AAA server does not have or support the default authorization information configured in the domain, the authorization configured in a domain takes effect.
When a domain and its users are configured with the same attribute but different attribute values, the user-based configuration is preferred over the domain-based configuration.