Cisco AS5800 Specifications download pdf (Page 169)

4-31

Cisco AS5800 Operations, Administration, Maintenance, and Provisioning Guide

DOC-7810814=

Chapter 4 Administration

Access Service Security

Specify the Authentication Method

After you identify a list name, you must specify an authentication method to identify how users will be

authenticated. Authentication methods are defined with optional keywords in the aaa authentication

command.

The following global configuration commands configure authentication methods for PPP.

Step 1 Configure for AAA.

5800-1(config)# aaa new-model

Step 2 Create a local authentication list. Methods include if-needed, krb5, local, none, radius, tacacs+.

5800-1(config)# aaa authentication ppp {default | list-name} method1 [method2]

Step 3 Apply the authentication list to a line or set of lines.

5800-1(config)# ppp authentication {chap | pap | chap pap | pap chap} [if-needed]

{default | list-name} [callin]

Step 4 Type Ctrl-Z to return to privileged EXEC mode.

5800-1(config)# Ctrl-Z

5800-1#

Step 5 Save your changes when ready.

5800-1# copy running-config startup-config

The keyword list-name is any character string used to name the list you are creating. The keyword

method refers to the actual method the authentication algorithm tries. The additional methods of

authentication are used only if the previous method returns an error, not if it fails. To specify that the

authentication should succeed even if all methods return an error, specify none as the final method in

the command line.

Timesaver If you are not sure whether you should use TACACS+ or RADIUS, consider the following:

TACACS+ encrypts the entire payload of packets passed across the network, whereas

RADIUS only encrypts the password when it crosses the network. TACACS+ can query

the security server multiple times, whereas a RADIUS server gives one response only and

is not as flexible regarding per-user authentication and authorization attempts.

You can specify multiple authentication methods for each authentication list. The following

authentication method example for PPP first queries a TACACS+ server, then a RADIUS server, then

the local security database. Multiple authentication methods can be useful if you have multiple types of

security servers on the network, and one or more types of security server do not respond.

5800-1(config)# aaa authentication ppp testbed tacacs+ radius local

If you specify more than one authentication method and the first method (TACACS+ in the previous

example) is not available, the Cisco IOS software attempts to authenticate using the next method (such

as RADIUS). If, in the previous example, the RADIUS server has no information about the user, or if

no RADIUS server can be found, the user is authenticated using the local username database that was

populated with the username command.

1 2 ... 164 165 166 167 168 169 170 171 172 173 174 ... 333 334

No comments

Cisco AS5800 Specifications Page 169