Configuration Guide 602
Configuring Network Security
AAA Configuration
On the Switch
The local username and password for login can be configured in the User Management
feature. For details, refer to
To configure the local Enable password for getting administrative privileges, follow these
steps:
Step 1
configure
Enter global configuration mode.
Step 2
enable admin password {
[ 0 ]
password
|
7
encrypted-password
}
Set the Enable password. This command uses symmetric encryption.
0 and 7 represent the encryption type. 0 indicates that an unencrypted key will follow. 7
indicates that a symmetric encrypted key with a fixed length will follow. By default, the
encryption type is 0.
password
is a string from 1 to 31 alphanumeric characters or symbols.
encrypted-password
is a symmetric encrypted key with a fixed length, which you can copy
from the configuration file of another switch. The key or encrypted-key you configured here
will be displayed in the encrypted form.
enable admin secret {
[ 0 ]
password
|
5
encrypted-password
}
Set the Enable password. This command uses MD5 encryption.
0 and 5 are the encryption type. 0 indicates that an unencrypted key will follow. 5 indicates
that an MD5 encrypted password with fixed length will follow. By default, the encryption
type is 0.
password
is a string from 1 to 31 alphanumeric characters or symbols.
encrypted-
password
is an MD5 encrypted password with fixed length, which you can copy from
another switch’s configuration file.
Step 3
end
Return to privileged EXEC mode.
Step 4
copy running-config startup-config
Save the settings in the configuration file.
On the Server
The accounts created by the RADIUS/ server can only view the configurations
and some network information without the Enable password.
Some configuration principles on the server are as follows:
For Login authentication configuration, more than one login account can be created on
the server. Besides, both the user name and password can be customized.
For Enable password configuration:
On RADIUS server, the user name should be set as
$enable$
, and the Enable password
is customizable. All the users trying to get administrative privileges share this Enable
password.
