Cisco 6500 - Catalyst Series 10 Gigabit EN Interface Module Expansion, Configuration Manual, Page: 534 / 742

23-12
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Chapter 23 Configuring Management Access
AAA for System Administrators
Enabling CLI or ASDM Authentication
To authenticate users who access the CLI or ASDM, enter the following command:
hostname(config)# aaa authentication { telnet | ssh | http } console { LOCAL |
server_group [ LOCAL ]}
The telnet keyword enables authentication for Telnet sessions, and when you configure this command
in the admin context, for sessioning from the switch to the FWSM.
The ssh keyword enables authentication for SSH sessions.
The http keyword authenticates the ASDM client that accesses the FWSM using HTTPS.
If you use a or RADIUS server group for authentication, you can configure the FWSM to use
the local database as a fallback method if the AAA server is unavailable. Specify the server group name
followed by
LOCAL ( LOCAL is case sensitive). We recommend that you use the same username and
password in the local database as the AAA server because the FWSM prompt does not give any
indication which method is being used.
You can alternatively use the local database as your main method of authentication (with no fallback) by
entering
LOCAL alone.
For example, to enable authentication for sessions from the switch to the FWSM system execution space,
enter the following commands starting from the switch CLI:
Router# session slot 1 processor 1
(for an FWSM in slot 1)
The default escape character is Ctrl-^, then x.
You can also type 'exit' at the remote prompt to end the session
Trying 127.0.0.41 ... Open
User Access Verification
Password: cisco
(the default login password)
Type help or ‘?’ for a list of available commands.
hostname> enable
hostname# configure terminal
hostname(config)# changeto context admin
(change from the system execution space to the admin
context called “admin”)
hostname/admin (config)# aaa-server RADS protocol radius
(adds a server group called RADS)
hostname/admin (config-aaa-server-group)# aaa-server RADS (mgmt) host 192.168.1.4 cisco
(adds a RADIUS server to the RADS server group)
hostname/admin (config-aaa-server-group)# exit
hostname/admin (config)# aaa authentication telnet console RADS
(enables Telnet
authentication using the RADS server group)
The next time you session from the switch to the FWSM, you are prompted for a username and password
defined on the RADIUS server:
Router# session slot 1 processor 1
The default escape character is Ctrl-^, then x.
You can also type 'exit' at the remote prompt to end the session
Trying 127.0.0.41 ... Open
User Access Verification
Username: myRADIUSusername
Password: myRADIUSpassword
Type help or ‘?’ for a list of available commands.