Cisco PIX 525 Especificações descarregar pdf (Página 129)

10-11

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 10 Configuring AAA Servers and the Local Database

Identifying AAA Server Groups and Servers

For example, the following command assigns a privilege level of 15 to the admin user account:

hostname/contexta(config)# username admin password passw0rd privilege 15

The following command creates a user account with no password:

hostname/contexta(config)# username bcham34 nopassword

The following commands creates a user account with a password, enters username mode, and specifies

a few VPN attributes:

hostname/contexta(config)# username rwilliams password gOgeOus

hostname/contexta(config)# username rwilliams attributes

hostname/contexta(config-username)# vpn-tunnel-protocol IPSec

hostname/contexta(config-username)# vpn-simultaneous-logins 6

hostname/contexta(config-username)# exit

Identifying AAA Server Groups and Servers

If you want to use an external AAA server for authentication, authorization, or accounting, you must first

create at least one AAA server group per AAA protocol and add one or more servers to each group. You

identify AAA server groups by name. Each server group is specific to one type of server: Kerberos,

LDAP, NT, RADIUS, SDI, or TACACS+.

The security appliance contacts the first server in the group. If that server is unavailable, the security

appliance contacts the next server in the group, if configured. If all servers in the group are unavailable,

the security appliance tries the local database if you configured it as a fallback method (management

authentication and authorization only). If you do not have a fallback method, the security appliance

continues to try the AAA servers.

To create a server group and add AAA servers to it, follow these steps:

Step 1 For each AAA server group you need to create, follow these steps:

a. Identify the server group name and the protocol. To do so, enter the following command:

hostname/contexta(config)# aaa-server

server_group

protocol {kerberos | ldap | nt |

radius | sdi | tacacs+}

For example, to use RADIUS to authenticate network access and TACACS+ to authenticate CLI

access, you need to create at least two server groups, one for RADIUS servers and one for TACACS+

servers.

You can have up to 15 single-mode server groups or 4 multi-mode server groups. Each server group

can have up to 16 servers in single mode or up to 4 servers in multi-mode.

When you enter a aaa-server protocol command, you enter group mode.

b. If you want to specify the maximum number of requests sent to a AAA server in the group before

trying the next server, enter the following command:

hostname/contexta(config-aaa-server-group)# max-failed-attempts

number

The number can be between 1 and 5. The default is 3.

If you configured a fallback method using the local database (for management access only; see the

“Authenticating and Authorizing System Administrators” section on page 30-4 and the

“Configuring TACACS+ Command Authorization” section on page 30-11 to configure the fallback

mechanism), and all the servers in the group fail to respond, then the group is considered to be

1 2 ... 124 125 126 127 128 129 130 131 132 133 134 ... 603 604

Comentários a estes Manuais

Sem comentários

Cisco PIX 525 Especificações Página 129

Comentários a estes Manuais