Cisco Wide Area Virtualization Engine 274 Troubleshooting Guide download pdf (Page 223)

1-15

Cisco Wide Area Application Services Configuration Guide

OL-26579-01

Chapter 1 Configuring Administrative Login Authentication, Authorization, and Accounting

Configuring Administrative Login Authentication and Authorization

TACACS+ authentication is disabled by default. You can enable TACACS+ authentication and local

authentication at the same time.

You can configure one primary and two backup TACACS+ servers; authentication is attempted on the

primary server first. If the primary server is unreachable, then authentication is attempted on the other

servers in the farm, in order. If authentication fails for any reason other than a server is unreachable,

authentication is not attempted on the other servers in the farm.

The TACACS+ database validates users before they gain access to a WAAS device. TACACS+ is derived

from the United States Department of Defense (RFC 1492) and is used by Cisco Systems as an additional

control of nonprivileged and privileged mode access. The WAAS software supports TACACS+ only and

not TACACS or Extended TACACS.

If you are using TACACS+ for user authentication, you can create WAAS user group names that match

the user groups that you have defined on the TACACS+ server. WAAS can then dynamically assign roles

and domains to users based on their membership in the groups defined on the TACACS+ server. (See the

“Working with Accounts” section on page 1-3.) You must specify associated group names for each user

in the TACACS+ configuration file, as follows:

user = tacusr1 {

default service = permit

service = exec

{

waas_rbac_groups = admin,groupname1,groupname2

priv-lvl = 15

}

global = cleartext "tac"

}

For each user, list the groups they belong to in the waas_rbac_groups attribute, separating each group

from the next with a comma.

The dynamic assignment of roles and domains based on external user groups requires a TACACS+ server

that supports shell custom attributes. For example, these are supported in Cisco ACS 4.x and 5.1 and

later.

Tip The WAAS Central Manager does not cache user authentication information, so the user is

reauthenticated against the TACACS+ server for every request. To prevent performance degradation

caused by many authentication requests, install the WAAS Central Manager device in the same location

as the TACACS+ server, or as close as possible to it, to ensure that authentication requests can occur as

quickly as possible.

Configuring TACACS+ Server Settings

The WAAS software CLI EXEC mode allows you to set, view, and test system operations. The mode is

divided into two access levels: user and privileged. To access privileged-level EXEC mode, enter the

enable EXEC command at the user access level prompt and specify the admin password when prompted

for a password.

In TACACS+, the enable password feature allows an administrator to define a different enable password

per administrative-level user. If an administrative-level user logs in to the WAAS device with a

normal-level user account (privilege level of 0) instead of an admin or admin-equivalent user account

(privilege level of 15), that user must enter the admin password to access privileged-level EXEC mode.

WAE> enable

Password:

1 ... 222 223 224 ... 594

Comments to this Manuals

No comments

Cisco Wide Area Virtualization Engine 274 Troubleshooting Guide Page 223

Comments to this Manuals

Related products and manuals for Networking Cisco Wide Area Virtualization Engine 274