Cisco IE 4000, Software Configuration Manual

Page: 150 / 1066

146
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
The goal of is to provide a method for managing multiple network access points from a single management
service. Your switch can be a network access server along with other Cisco routers and access servers. A network
access server provides connections to a single user, to a network or subnetwork, and to interconnected networks as
shown in
Figure 16 on page 146 .
Figure 16 Typical Network Configuration
, administered through the AAA security services, can provide these services:

Authentication—Provides complete control of authentication through login and password dialog, challenge and
response, and messaging support.
The authentication facility can conduct a dialog with the user (for example, after a username and password are
provided, to challenge a user with several questions, such as home address, mother’s maiden name, service type,
and social security number). The authentication service can also send messages to user screens. For
example, a message could notify users that their passwords must be changed because of the company’s password
aging policy.

Authorization—Provides fine-grained control over user capabilities for the duration of the user’s session, including
but not limited to setting autocommands, access control, session duration, or protocol support. You can also enforce
restrictions on what commands a user can execute with the authorization feature.

Accounting—Collects and sends information used for billing, auditing, and reporting to the daemon.
Network managers can use the accounting facility to track user activity for a security audit or to provide information
for user billing. Accounting records include user identities, start and stop times, executed commands (such as PPP),
number of packets, and number of bytes.
The protocol provides authentication between the switch and the daemon, and it ensures
confidentiality because all protocol exchanges between the switch and the daemon are encrypted.
You need a system running the daemon software to use on your switch.
101230
UNIX workstation
(
server 2)
UNIX workstation
(
server 1)
Configure the switches with the
server addresses.
Set an authentication key
(also configure the same key on
the servers).
Enable AAA.
Create a login authentication method list.
Apply the list to the terminal lines.
Create an authorization and accounting
method list as required.
Catalyst 6500
series switch
Workstations
171.20.10.8
171.20.10.7
Workstations