Asentria SiteBoss 530 User Manual
87
Note that the Asentria-Filex-* and Asentria-Portx-* attributes are required for only however many serial ports on the
unit. For example, if you have a unit with only 2 ports, then only Asentria-File1-*, Asentria-File2-*, Asentria-Port1-*,
and Asentria-Port2-* attributes are required by that unit for the given connection method.
Note that "N/A in phase 2" means that this attribute is not used in phase 2 of the RADIUS feature (phase 2 supports
everything except PPP and SSH).
Benefit
In a typical application environment for these units, there is hardware from other vendors too, and each piece of
hardware probably has its own way of doing AAA operations. As the number of disparate machines rises, so does the
administration headache of maintaining AAA for each machine for each user. If all machines use a standard,
centralized AAA architecture however, then that simplifies administration of all of them and makes each one fit more
easily in into the entire application environment. Therefore, having a unit support AAA (via RADIUS, one of the most-
deployed and most-mature of AAA servers) makes it easier for organizations to fit units into their environments.
Configuration
To configure RADIUS on the unit (minimum required configuration) enter the Setting Key values as shown below, or
onfigure using the
sec.mode
=RADIUS
sec.radius.server[1]
=<address or hostname>
sec.radius.server[1].secret
=<secret>
To configure other parts of RADIUS (optional):
sec.radius.server[2]
=<address or hostname>
sec.radius.server[2].secret
=<secret>
sec.radius.fallback.mode
=<NONE or USER PROFILES>
sec.radius.auth.port
=<UDP port that server uses for authentication/authorization>
sec.radius.acct.port
=<UDP port that server uses for accounting, or 0>
sec.radius.chap
=<ON or OFF>
sec.radius.timeout
=<timeout in seconds, 1 to 30>
sec.radius.retries
=<number of retries, 0 to 30>
Example
Say you want to configure user "bob" to access the unit's modem command processor via RADIUS. First configure
"bob" on the RADIUS server. He may already be configured on your RADIUS server because his duties may include
administering other RADIUS-supporting machines besides the unit. Either way, you must configure the following
attributes for "bob" on the RADIUS server (this list is generated by looking at the table above and seeing which
attributes are required by the "T" method (telnet command processor). (Say the unit has only 2 serial ports to minimize
the File/Port authorization attributes listed here.)
Asentria-Connect-Via-Telnet = ON
Asentria-Log-In-To = COMMAND
Asentria-Access-File = FILE1
Asentria-User-Rights = ADMIN3
Asentria-File1-Read-Access = ALLOW
Asentria-File2-Read-Access = ALLOW
Asentria-File1-Write-Access = ALLOW
Asentria-File2-Write-Access = ALLOW
Asentria-Events-Read-Access = ALLOW
Asentria-Audit-Read-Access = ALLOW
Asentria-Events-Write-Access = DENY
Asentria-Audit-Write-Access = DENY
Asentria-Port1-PT-Access = ALLOW
Asentria-Port2-PT-Access = ALLOW
This list of attributes for user "bob" on the RADIUS server specifies that he can access the unit's telnet command
processor with ADMIN3 rights, the access file set to FILE1 and all files/ports readable and writable except that the he
cannot write the events and audit files
.
Also configure a user for yourself that gives you MASTER rights to the unit should you need access to it.
Содержание SiteBoss 530
Страница 6: ......
