Cisco AS5800 Specifications download pdf (Page 172)

4-34

Cisco AS5800 Operations, Administration, Maintenance, and Provisioning Guide

DOC-7810814=

Chapter 4 Administration

Access Service Security

In the following example, the login authentication list named rtp2-office, which uses RADIUS

authentication, is created. It is applied to all 54 lines on an configured with a channelized T1 PRI card,

including the console (CTY) port, the 48 physical asynchronous (TTY) lines, the auxiliary (AUX) port,

and 69 virtual terminal (VTY) lines:

5800-1(config)# aaa authentication login rtp2-office radius

5800-1(config)# line 0 118

5800-1(config-line)# login authentication rtp2-office

The following sample output shows lines and their status on the Cisco AS5800.

5800-1# show line

Tty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns

* 0 CTY - - - - - 0 0 0/0

I 1 TTY 115200/115200 - inout - - - 0 0 0/0

I 2 TTY 115200/115200 - inout - - - 0 0 0/0

...

I 48 TTY 115200/115200 - inout - - - 0 0 0/0

49 AUX 9600/9600 - - - - - 0 0 0/0

50 VTY - - - - - 0 0 0/0

51 VTY - - - - - 0 0 0/0

52 VTY - - - - - 0 0 0/0

53 VTY - - - - - 0 0 0/0

54 VTY - - - - - 0 0 0/0

PPP Authentication Example

The following example creates the PPP authentication list marketing, which uses TACACS+, and

RADIUS authentication. The list marketing requires authentication only if the user has not been

authenticated on another line. It is then applied to asynchronous lines 1-48 on a Cisco AS5800 and uses

CHAP authentication, instead of the default of PAP.

5800-1(config)# aaa authentication ppp marketing if-needed tacacs+ radius

5800-1(config)# line shelf/slot/1 shelf/slot/48

5800-1(config-line)# ppp authentication chap marketing

TACACS+ Authorization

You can configure the Cisco AS5800 to restrict user access to the network so that users can only perform

certain functions after successful authentication. As with authentication, authorization can be used with

either a local or remote security database. This guide describes only remote security server

authorization.

A typical configuration often uses the EXEC facility and network authorization. EXEC authorization

restricts access to the EXEC, and network authorization restricts access to network services, including

PPP.

Authorization must be configured on both the Cisco AS5800 and the security daemon. The default

authorization is different on the Cisco AS5800 and the security server:

• By default, the Cisco AS5800 permits access for every user until you configure the system to make

authorization requests to the daemon.

• By default, the daemon denies authorization of anything that is not explicitly permitted. Therefore,

you have to explicitly allow all per-user attributes on the security server.

1 2 ... 167 168 169 170 171 172 173 174 175 176 177 ... 333 334

Comments to this Manuals

No comments

Cisco AS5800 Specifications Page 172

Comments to this Manuals

Related products and manuals for Servers Cisco AS5800