Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 876 / 2164

1-30
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring AAA Servers and the Local Database
Configuring AAA
•
Using LDAP Authentication, page 1-30
•
Using Authentication, page 1-31
Using Local Authentication
Before you configure the service-type attribute and privilege level when using local authentication, you
must create a user, assign a password, and assign a privilege level. To do so, enter the following
command:
hostname(config)# username admin password mysecret123 privilege 15
Where mysecret123 is the stored password and 15 is the assigned privilege level, which indicates an
admin user.
The available configuration options for the service-type attribute include the following:
•
admin , in which users are allowed access to the configuration mode. This option also allows a user
to connect via remote access.
•
nas-prompt , in which users are allowed access to the EXEC mode.
•
remote-access , in which users are allowed access to the network.
The following example designates a service-type of admin for a user named admin:
hostname(config)# username admin attributes
hostname(config-username)# service-type admin
The following example designates a service-type of remote-access for a user named ra-user:
hostname(config)# username ra-user attributes
hostname(config-username)# service-type remote-access
Using RADIUS Authentication
The RADIUS IETF service-type attribute, when sent in an access-accept message as the result of a
RADIUS authentication and authorization request, is used to designate which type of service is granted
to the authenticated user. The supported attribute values are the following: administrative(6),
nas-prompt(7), Framed(2), and Login(1). For a list of supported RADIUS IETF VSAs used for
authentication and authorization, see
Table 1-8 on page 1-36 .
For more information about using RADIUS authentication, see “Configuring an External RADIUS
Server” section on page 1-25 . For more information about configuring RADIUS authentication for Cisco
Secure ACS, see the Cisco Secure ACS documentation on Cisco.com.
The RADIUS Cisco VSA privilege-level attribute (Vendor ID 3076, sub-ID 220), when sent in an
access-accept message, is used to designate the level of privilege for the user. For a list of supported
RADIUS VSAs used for authorization, see
Table 1-7 on page 1-27 .
Using LDAP Authentication
When users are authenticated through LDAP, the native LDAP attributes and their values can be mapped
to Cisco ASA attributes to provide specific authorization features. For the supported list of LDAP VSAs
used for authorization, see
Table 1-2 on page 1-5 .
You can use the LDAP attribute mapping feature for LDAP authorization. For examples of this feature,
see the
“Understanding Policy Enforcement of Permissions and Attributes” section on page 1-1 .