Cisco Catalyst 2960 Series, Configuration Manual

Page: 978 / 2288

if-needed keyword means that if the user has already authenticated by going through the ASCII login
procedure, then PPP authentication is not necessary and can be skipped. If authentication is needed, the
keyword
group means that authentication will be done through . If
returns an ERROR of some sort during authentication, the keyword local indicates that authentication
will be attempted using the local database on the network access server.
• The aaa authorization command configures network authorization via . Unlike authentication
lists, this authorization list always applies to all incoming network connections made to the network
access server.
• The tacacs-server host command identifies the daemon as having an IP address of 10.1.2.3.
The
tacacs-server key
command defines the shared encryption key to be “ goaway. ”
• The interface command selects the line, and the ppp authentication command applies the default
method list to this line.
Example: TACACS Accounting
The following example shows how to configure as the security protocol for PPP authentication
using the default method list; it also shows how to configure accounting via :
aaa new-model
aaa authentication ppp default if-needed group local
aaa accounting network default stop-only group
tacacs-server host 10.1.2.3
tacacs-server key goaway
interface serial 0
ppp authentication chap default
The lines in the preceding sample configuration are defined as follows:
• The aaa new-model command enables the AAA security services.
•
The aaa authentication command defines a method list,
“
default,
”
to be used on serial interfaces running
PPP. The keyword default means that PPP authentication is applied by default to all interfaces. The
if-needed keyword means that if the user has already authenticated by going through the ASCII login
procedure, then PPP authentication is not necessary and can be skipped. If authentication is needed, the
keyword
group means that authentication will be done through . If
returns an ERROR of some sort during authentication, the keyword local indicates that authentication
will be attempted using the local database on the network access server.
• The aaa accounting command configures network accounting via . In this example, accounting
records describing the session that just terminated will be sent to the daemon whenever a
network connection terminates.
• The tacacs-server host command identifies the daemon as having an IP address of 10.1.2.3.
The
tacacs-server key
command defines the shared encryption key to be “ goaway. ”
• The
interface
command selects the line, and the
ppp authentication
command applies the default
method list to this line.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
896
Configuration Examples for