Cisco AS5300 - Universal Access Server, Руководство по настройке программного обеспечения, Страница: 119 / 198

Access Service Security 4-13
Defining Authentication Method Lists
Note RADIUS does not support ARA. To authenticate Macintosh users with RADIUS, you must
configure AppleTalk to run over PPP, which is referred to as ATCP.
You can specify multiple authentication methods for each authentication list. The following example
authentication method list for PPP first queries a server, then a RADIUS server, then the
local security database. Multiple authentication methods can be useful if you have multiple types of
security servers on the network and one or more types of security servers do not respond:
5300(config)# aaa authentication ppp testbed radius local
If you specify more than one authentication method and the first method ( in the previous
example) is not available, the Cisco IOS software attempts to authenticate using the next method
(such as RADIUS). If in the previous example, the RADIUS server has no information about the
user, or if no RADIUS server can be found, the user is authenticated using the local username
database that was populated with the username command.
However, if authentication fails using the first method listed, the Cisco IOS software does not permit
access. It does not attempt to authenticate using the subsequent security methods if the user entered
the incorrect password.
Populate the Local Username Database if Necessary
If you specify local as the security method, you must specify username profiles for each user who
might log in. An example of specifying local authentication is as follows:
5300(config)# aaa authentication login deveng local
This command specifies that any time a user attempts to log in to a line on an access server, the
Cisco IOS software checks the username database. To create a local username database, define
username profiles using the username global configuration command.
The following example shows how to use the username command for a user cpatino with password
n1vriti:
5300(config)# username cpatino password n1vriti
The show running-config command shows the encrypted version of the password, as follows:
5300# show running-config
Building configuration...
Current configuration:
!
version 11.1
! most of config omitted
username cpatino password 7 0215055500070C294D
Note
The Cisco IOS software adds the encryption type of 7 automatically for passwords. If you
were to manually enter the number 7 to represent an encryption type, you must follow the 7 with the
encrypted version of the password. If you specify the number 7, then enter a cleartext password, the
user will not have access to the line, interface, or the network the user is trying to access, and you
must reconfigure the user’s authentication profile.