Command Line Interface 66
server configuration
Command:
/cfg/sys/
[ Server Menu]
prisrv - Set IP address of primary server
secsrv - Set IP address of secondary server
secret - Set secret for primary server
secret2 - Set secret for secondary server
port - Set port number
retries - Set number of server retries
timeout - Set timeout value of server retries
bckdoor - Enable/disable backdoor for telnet/ssh/http/https
secbd - Enable/disable secure backdoor
cmap - Enable/disable new privilege level mapping
usermap - Set user privilege mappings
on - Enable authentication
off - Disable authentication
cur - Display current settings
(Terminal Access Controller Access Control System) is an authentication protocol that allows a remote
access server to forward a user's logon password to an authentication server to determine whether access can be
allowed to a given system. and Remote Authentication Dial-In User Service (RADIUS) protocols are
more secure than the TACACS encryption protocol. is described in RFC 1492.
protocol is more reliable than RADIUS, as uses the Transmission Control Protocol (TCP)
whereas RADIUS uses the User Datagram Protocol (UDP). Also, RADIUS combines authentication and
authorization in a user profile, whereas separates the two operations.
offers the following advantages over RADIUS as the authentication device:
•
is TCP-based, so it facilitates connection-oriented traffic.
•
It supports full-packet encryption, as opposed to password-only in authentication requests.
•
It supports decoupled authentication, authorization, and accounting.
The following table describes the Server Configuration Menu options.
Table 62 Server Configuration Menu options
Command Description
prisrv <
IP address
>
Defines the primary server address.
secsrv <
IP address
>
Defines the secondary server address.
secret <
1-32 characters
>
This is the shared secret between the switch and the server(s).
secret2 <
1-32 characters
>
This is the secondary shared secret between the switch and the
server(s).
port <
TCP port number
>
Enter the number of the TCP port to be configured, between 1 - 65000. The
default is 49.
retries <
1-3
>
Sets the number of failed authentication requests before switching to a
different server. The range is 1-3 requests. The default is 3
requests.
timeout <
4-15
>
Sets the amount of time, in seconds, before a server
authentication attempt is considered to have failed. The range is 4-15
seconds. The default is 5 seconds.
bckdoor enable|disable
Enables or disables the back door for telnet. The
telnet
command also applies to
SSH/SCP connections and the Browser-based
Interface (BBI). The default value is disabled. This command does not apply
when secure backdoor (
secbd
) is enabled.
secbd enable|disable
Enables or disables the back door using secure password for
telnet/SSH/ HTTP/HTTPS. The default value is disabled. This command
does not apply when backdoor (
bckdoor
) is enabled.
cmap enable|disable
Enables or disables authorization-level mapping.
The default value is
disabled
.
usermap <
0-15
>
user|oper|admin|none
Maps a authorization level to this switch user level. Enter a
authorization level (0-15), followed by the corresponding this
switch user level.
on
Enables the server.
off
Disables the server. This is the default.
cur
Displays current configuration parameters.
