Cisco Explorer 4700 Installation Guide download pdf (Page 571)

100

101

15-3

Device Manager Guide, Cisco ACE 4700 Series Application Control Engine Appliance

OL-26645-02

Chapter 15 Managing the ACE Appliance

Controlling Access to the Cisco ACE Appliance

Access to ACE Appliance Device Manager is controlled using the same username and password that

access the ACE appliance. This enables authentication to a local database or to an external RADIUS,

TACACS+, or LDAP server. If you choose to authenticate using AAA and not the local database, you

must configure AAA using the CLI. For details on setting up remote authentication using AAA servers,

see the Security Guide, Cisco ACE Application Control Engine.

Note The ACE supports local user authentication using a local database on the ACE or through remote

authentication using one or more AAA servers. AAA remote servers are grouped into independent

groups of TACACS+, RADIUS, or LDAP servers. Authentication allows you to control user access to

the ACE by requiring specification of a valid username and password, or no password verification. When

you configure the ACE appliance from the CLI to support the user authentication and accounting

functions, the Device Manager honors the tasks that are performed by the specified remote server. See

the Security Guide, Cisco ACE Application Control Engine for details about authentication and

accounting.

In addition, the role and domains that a user is associated with on a remote server will also honored by

the Device Manager.

The ACE Appliance Device Manager does not configure AAA; instead, it uses role-based access control

for access to features. When a user logs into the system, the specific tasks they can perform and areas of

the system they can use are controlled by contexts, roles, and domains. If you need to restrict a user’s

access, you must first assign a role-domain pair.

The role assigned to a user defines the tasks a user can perform and the items in the hierarchy that they

can see. Roles are either predefined or set up by the system administrator. Each role, user, and domain

is associated with a context. Only roles and domains associated with the Admin context can see other

contexts. See Understanding Roles, page 15-5 for more information.

A domain is a collection of managed objects. When a user is given access to a domain, this acts as a filter

for a subset of objects on the network which are displayed as a virtual context. The types of objects in

the system that are domain controlled are as follows:

• All objects listed below

• Access list—Ethertype

• Access list—Extended

• Class-map

• Interface VLAN

• Interface BVI

• Parameter-map

• Policy-map

• Probe

• Real server

• Script

• Server farm

• Sticky

1 ... 570 571 572 ... 648

Comments to this Manuals

No comments

Cisco Explorer 4700 Installation Guide Page 571

Comments to this Manuals

Related products and manuals for Digital Video Recorders (DVR) Cisco Explorer 4700