Cisco AS5800 Specifications download pdf (Page 167)

4-29

Cisco AS5800 Operations, Administration, Maintenance, and Provisioning Guide

DOC-7810814=

Chapter 4 Administration

Access Service Security

Enabling AAA Globally

To use the AAA security facility in the Cisco IOS software, you must issue the aaa new-model

command from global configuration mode.

When you issue the aaa new-model command, all lines on the Cisco AS5800 receive the implicit

ppp authentication pap default method list applied.

Caution If you authenticate users by a security server, do not inadvertently lock yourself out of the

Cisco AS5800 ports after you issue the aaa new-model command. Enter line configuration

mode and issue the aaa authentication login default tacacs+ enable global configuration

command. This command specifies that if your TACACS+ (or RADIUS) server is not

functioning properly, you can enter your enable password to log in to the Cisco AS5800.

In general, verify that you have a last-resort access method before you are certain that your

security server is set up and functioning properly. For more information about the

aaa authentication command, refer to the “Defining Authentication Method Lists” section

on page 4-29.

Note Cisco recommends that you use CHAP authentication with PPP, rather than PAP. CHAP

passwords are encrypted when they cross the network, whereas PAP passwords are

cleartext when they cross the network. The Cisco IOS software selects PAP as the default,

so you must manually select CHAP. The process for specifying CHAP is described in

Applying Authentication Method Lists, page 4-33.

5800-1# configure terminal

5800-1(config)# aaa new-model

Defining Authentication Method Lists

After you enable AAA globally on the Cisco AS5800, you need to define authentication method lists,

which you then apply to lines and interfaces. These authentication method lists are security profiles that

indicate the protocol (PPP) or login and authentication method (TACACS+, RADIUS, or local

authentication).

To define an authentication method list:

1. Issue the aaa authentication command.

2. Specify protocol (PPP) or login authentication.

3. Identify a list name or default. A list name is any alphanumeric string you choose. You assign

different authentication methods to different named lists.

4. Specify the authentication method. You can specify multiple methods, such as tacacs+, followed by

local if a TACACS+ server is not available on the network.

5. Populate the local username database if you specified local as the authentication method (or one of

the authentication methods). To use a local username database, you must issue the username global

configuration command. Refer to the “Populate the Local Username Database if Necessary” section

on page 4-32.

After defining these authentication method lists, apply them to your interfaces (synchronous or

asynchronous) configured for PPP.

1 2 ... 162 163 164 165 166 167 168 169 170 171 172 ... 333 334

Comments to this Manuals

No comments

Cisco AS5800 Specifications Page 167

Comments to this Manuals

Related products and manuals for Servers Cisco AS5800