11-11
Cisco IE 3000 Switch Software Configuration Guide
OL-13018-03
Chapter 11 Configuring Switch-Based Authentication
Controlling Switch Access with
Figure 11-1
Typical Network Configuration
, administered through the AAA security services, can provide these services:
•
Authentication—Provides complete control of authentication through login and password dialog,
challenge and response, and messaging support.
The authentication facility can conduct a dialog with the user (for example, after a username and
password are provided, to challenge a user with several questions, such as home address, mother’s
maiden name, service type, and social security number). The authentication service can
also send messages to user screens. For example, a message could notify users that their passwords
must be changed because of the company’s password aging policy.
•
Authorization—Provides fine-grained control over user capabilities for the duration of the user’s
session, including but not limited to setting autocommands, access control, session duration, or
protocol support. You can also enforce restrictions on what commands a user can execute with the
authorization feature.
•
Accounting—Collects and sends information used for billing, auditing, and reporting to the
daemon. Network managers can use the accounting facility to track user activity for a
security audit or to provide information for user billing. Accounting records include user identities,
start and stop times, executed commands (such as PPP), number of packets, and number of bytes.
The protocol provides authentication between the switch and the daemon, and it
ensures confidentiality because all protocol exchanges between the switch and the daemon
are encrypted.
You need a system running the daemon software to use on your switch.
1012
3
0
UNIX work
s
t
a
tion
(TACAC
S
+
s
erver 2)
UNIX work
s
t
a
tion
(TACAC
S
+
s
erver 1)
Configure the
s
witche
s
with the
TACAC
S
+
s
erver
a
ddre
ss
e
s
.
S
et
a
n
a
uthentic
a
tion key
(
a
l
s
o configure the
sa
me key on
the TACAC
S
+
s
erver
s
).
En
a
ble AAA.
Cre
a
te
a
login
a
uthentic
a
tion method li
s
t.
Apply the li
s
t to the termin
a
l line
s
.
Cre
a
te
a
n
a
uthoriz
a
tion
a
nd
a
ccounting
method li
s
t
as
required.
C
a
t
a
ly
s
t 6500
s
erie
s
s
witch
Work
s
t
a
tion
s
171.20.10.8
171.20.10.7
Work
s
t
a
tion
s
