AudioCodes Mediant 500 MSBR, Руководство пользователя

Страница: 90 / 1248

User's Manual 90 Document #: LTRT-10375
Mediant 500 MSBR

Authentication: provides authentication through login and password dialog

Authorization: manages user capabilities for the duration of the user's session by
placing restrictions on what commands a user may execute

Accounting: collects and sends information for auditing and reporting to the
daemon
The protocol provides authentication between the device and the
daemon, and it ensures confidentiality as all protocol exchanges between a network
access server and a daemon are encrypted. You need a system running
daemon software to use the functionality on your network access
server.
When a user attempts a simple ASCII login by authenticating to a network access server
using , the following typically occurs:
1. When the connection is established, the network access server contacts the
daemon to obtain a username prompt, which is then displayed to the user.
The user enters a username and the network access server then contacts the
daemon to obtain a password prompt. The network access server displays
the password prompt to the user, the user enters a password, and the password is
then sent to the daemon.
2. The network access server eventually receives one of the following responses from
the daemon:
•
ACCEPT: The user is authenticated and service may begin. If the network access
server is configured to require authorization, authorization will begin at this time.
•
REJECT: The user has failed to authenticate. The user may be denied further
access.
•
ERROR: An error occurred at some time during authentication. This can be at the
daemon or in the network connection between the daemon and the network
access server. If an ERROR response is received, the device typically attempts
to use an alternative method for authenticating the user.
3. If authorization is needed, the daemon is again contacted for
each CLI command entered by the user, and it returns an ACCEPT or REJECT
authorization response. If an ACCEPT response is returned, the CLI command is
allowed; otherwise, it is rejected.
To configure in the CLI, use the following commands:

To enable :
(config-data)# aaa authentication login

To configure the IP address of the server (up to two servers can be
configured):
(config-data)# tacacs-server host <IP address>

To configure the TCP port number for the service:
(config-data)# tacacs-server port <port>

To configure the shared secret between the server and the device:
(config-data)# tacacs-server key <password>

To configure how much time to wait for a response before failing the
authentication:
(config-data)# tacacs-server timeout <in seconds>

To configure the device's data-router WAN interface through which communication
with the server is done:
(config-data)# tacacs-server source data source-address
interface <interface name>