Cisco AS5300 - Universal Access Server, Software Configuration Manual, Page: 122 / 198

Configuring Authentication
Cisco AS5300 Universal Access Server Software Configuration Guide 4-16
The following sample output shows lines and their status on the access server:
5300# sho line
Tty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns
* 0 CTY - - - - - 0 0 0/0
I 1 TTY 57600/57600 - inout - - - 0 0 0/0
I 2 TTY 57600/57600 - inout - - - 0 0 0/0
...
I 48 TTY 57600/57600 - inout - - - 0 0 0/0
49 AUX 9600/9600 - - - - - 0 0 0/0
50 VTY - - - - - 0 0 0/0
51 VTY - - - - - 0 0 0/0
52 VTY - - - - - 0 0 0/0
53 VTY - - - - - 0 0 0/0
54 VTY - - - - - 0 0 0/0
ARA Authentication Examples
In the following example, the ARA authentication list bldg-d-list is created, then applied to lines
1 through 48 (the physical asynchronous lines) on an access server:
5300(config)# aaa authentication arap bldg-d-list auth-guest
5300(config)# line 1 48
5300(config-line)# arap authentication bldg-d-list
PPP Authentication Examples
The following example creates the PPP authentication list called marketing, which uses ,
then RADIUS authentication. The marketing list requires authentication only if the user has not
already been authenticated on another line. It is then applied to asynchronous lines 1 through 48 on
an access server and uses CHAP authentication, instead of the default of PAP:
5300(config)# aaa authentication ppp marketing if-needed radius
5300(config)# line 1 48
5300(config-line)# ppp authentication chap marketing
Configuring Authorization
You can configure the access server to restrict user access to the network so that users can only
perform certain functions after successful authentication. As with authentication, authorization can
be used with either a local or remote security database. This guide describes only remote security
server authorization.
A typical configuration probably uses the EXEC facility and network authorization. EXEC
authorization restricts access to EXEC mode, and network authorization restricts access to network
services, including PPP and ARA.
Authorization must be configured on both the access server and the security daemon. The default
authorization is different on the access server and the security server:
•
By default, the access server permits access for every user until you configure the access server
to make authorization requests to the daemon.
•
By default, the daemon denies authorization of anything that is not explicitly permitted.
Therefore, you have to explicitly allow all per-user attributes on the security server.
Timesaver If authentication has not been set up for a user, per-user authorization attributes are not enabled
for that user. That is, if you want a user to obtain authorization before gaining access to network resources,
you must first require that the user provide authentication. For example, if you want to specify the
aaa authorization network (or radius) command, you must first specify the
aaa authentication {ppp | arap} default if-needed (or radius) command.
12
6
9 3