Dell BigIron RX Series, Configuration Manual

Page: 188 / 1458

112 BigIron RX Series Configuration Guide
53-1002253-01
Configuring authentication-method lists
4
Configuring authentication-method lists
To implement one or more authentication methods for securing access to the device, you configure
authentication-method lists that set the order in which the authentication methods are consulted.
In an authentication-method list, you specify the access method (Telnet, Web, SNMP, and so on)
and the order in which the device tries one or more of the following authentication methods:
•
Local Telnet login password
•
Local password for the Super User privilege level
•
Local user accounts configured on the device
•
Database on a TACACS or server
•
Database on a RADIUS server
•
No authentication
NOTE
The TACACS and , RADIUS, and Telnet login password authentication methods are not
supported for SNMP access.
NOTE
To authenticate Telnet access to the CLI, you also must enable the authentication by entering the
enable telnet authentication command at the global CONFIG level of the CLI. You cannot enable
Telnet authentication using the Web management interface.
NOTE
You do not need an authentication-method list to secure access based on ACLs or a list of IP
addresses. Refer to
“Using ACLs to restrict remote access” on page 63 or “Restricting remote access
to the device to specific IP addresses” on page 66.
In an authentication-method list for a particular access method, you can specify up to seven
authentication methods. If the first authentication method is successful, the software grants
access and stops the authentication process. If the access is rejected by the first authentication
method, the software denies access and stops checking.
However, if an error occurs with an authentication method, the software tries the next method on
the list, and so on. For example, if the first authentication method is the RADIUS server, but the link
to the server is down, the software will try the next authentication method in the list.
NOTE
If an authentication method is working properly and the password (and user name, if applicable) is
not known to that method, this is not an error. The authentication attempt stops, and the user is
denied access.
The software will continue this process until either the authentication method is passed or the
software reaches the end of the method list. If the Super User level password is not rejected after
all the access methods in the list have been tried, access is granted.
NOTE
If a user cannot be authenticated using local authentication, then the next method on the
authentication methods list is used to try to authenticate the user. If there is no method following
local authentication, then the user is denied access to the device.