Cisco Catalyst 2960 Series, Configuration Manual

Page: 835 / 2288

C H A P T E R
33
Preventing Unauthorized Access
• Finding Feature Information, page 753
• Preventing Unauthorized Access, page 753
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest caveats and
feature information, see Bug Search Tool and the release notes for your platform and software release. To
find information about the features documented in this module, and to see a list of the releases in which each
feature is supported, see the feature information table at the end of this module.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support.
To access Cisco Feature Navigator, go to
http://www.cisco.com/go/cfn . An account on Cisco.com is not
required.
Preventing Unauthorized Access
You can prevent unauthorized users from reconfiguring your switch and viewing configuration information.
Typically, you want network administrators to have access to your switch while you restrict access to users
who dial from outside the network through an asynchronous port, connect from outside the network through
a serial port, or connect through a terminal or workstation from within the local network.
To prevent unauthorized access into your switch, you should configure one or more of these security features:
• At a minimum, you should configure passwords and privileges at each switch port. These passwords
are locally stored on the switch. When users attempt to access the switch through a port or line, they
must enter the password specified for the port or line before they can access the switch.
• For an additional layer of security, you can also configure username and password pairs, which are
locally stored on the switch. These pairs are assigned to lines or ports and authenticate each user before
that user can access the switch. If you have defined privilege levels, you can also assign a specific
privilege level (with associated rights and privileges) to each username and password pair.
• If you want to use username and password pairs, but you want to store them centrally on a server instead
of locally, you can store them in a database on a security server. Multiple networking devices can then
use the same database to obtain user authentication (and, if necessary, authorization) information.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
753