11-16
Cisco IE 3000 Switch Software Configuration Guide
OL-13018-03
Chapter 11 Configuring Switch-Based Authentication
Controlling Switch Access with
To disable AAA, use the
no aaa new-model
global configuration command. To disable AAA
authentication, use the
no aaa authentication login
{
default
|
list-name
}
method1
[
method2...
] global
configuration command. To either disable authentication for logins or to return to the default
value, use the
no login authentication
{
default
|
list-name
} line configuration command.
Note
To secure the switch for HTTP access by using AAA methods, you must configure the switch with the
ip http authentication aaa
global configuration command. Configuring AAA authentication does not
secure the switch for HTTP access by using AAA methods.
For more information about the
ip http authentication
command, see the
Cisco IOS Security Command
Reference, Release 12.2
from the Cisco.com page under
Documentation
>
Cisco IOS Software
>
12.2
Mainline
>
Command References
.
Configuring Authorization for Privileged EXEC Access and Network Services
AAA authorization limits the services available to a user. When AAA authorization is enabled, the
switch uses information retrieved from the user’s profile, which is located either in the local user
database or on the security server, to configure the user’s session. The user is granted access to a
requested service only if the information in the user profile allows it.
You can use the
aaa authorization
global configuration command with the
keyword to set
parameters that restrict a user’s network access to privileged EXEC mode.
The
aaa authorization exec local
command sets these authorization parameters:
•
Use for privileged EXEC access authorization if authentication was performed by using
.
•
Use the local database if authentication was not performed by using .
Note
Authorization is bypassed for authenticated users who log in through the CLI even if authorization has
been configured.
Beginning in privileged EXEC mode, follow these steps to specify authorization for
privileged EXEC access and network services:
Command
Purpose
Step 1
configure terminal
Enter global configuration mode.
Step 2
aaa authorization network
Configure the switch for user authorization for all
network-related service requests.
Step 3
aaa authorization exec
Configure the switch for user authorization if the user has
privileged EXEC access.
The
exec
keyword might return user profile information (such as
autocommand
information).
Step 4
end
Return to privileged EXEC mode.
Step 5
show running-config
Verify your entries.
Step 6
copy running-config startup-config
(Optional) Save your entries in the configuration file.
