39-2
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 39 Configuring the Switch Access Using AAA
Understanding How Authentication Works
Understanding How Authentication Works
These sections describe how the different authentication methods work:
•
Authentication Overview, page 39-2
•
Understanding How Login Authentication Works, page 39-2
•
Understanding How Local Authentication Works, page 39-3
•
Understanding How Local User Authentication Works, page 39-3
•
Understanding How Authentication Works, page 39-4
•
Understanding How RADIUS Authentication Works, page 39-5
•
Understanding How Kerberos Authentication Works, page 39-5
Authentication Overview
You can configure any combination of these authentication methods to control access to the switch:
•
Login authentication
•
Local authentication
•
RADIUS authentication
•
authentication
•
Kerberos authentication
Note
Kerberos authentication does not work if is used as the authentication method.
When you enable local authentication with one or more other authentication methods, local
authentication is always attempted last. However, you can specify different authentication methods for
the console and Telnet connections. For example, you might use local authentication for the console
connections and RADIUS authentication for the Telnet connections.
Understanding How Login Authentication Works
Login authentication increases the security of the system by keeping the unauthorized users from
guessing the password. The user is limited to a specific number of attempts to successfully log in to the
switch. If the user fails to authorize the password, the system delays the accesses and captures the user
ID and the IP address of the station in the syslog and in the SNMP trap.
The maximum number of login attempts is configurable from the CLI and SNMP through the
set
authentication login attempt
count
command. Enter the
set authentication enable attempt
count
command to set the login limits for accessing enable mode. The configurable range is three (default) to
ten tries. Setting the login authentication limit to zero (0) disables this function.
All authentication methods are supported (RADIUS, , Kerberos, or local).
You can configure the lockout (delay) time from the CLI and SNMP through the
set authentication login
lockout
time
command. Use the
set authentication enable lockout
time
command to set a delay time for
accessing enable mode. The configurable range is 30–43200 seconds. Setting the lockout time to zero (0)
disables
this function.
