Cisco Catalyst 2360, Руководство по настройке программного обеспечения

Страница: 117 / 554

7-11
Catalyst 2360 Switch Software Configuration Guide
OL-19808-01
Chapter 7 Configuring Switch-Based Authentication
Controlling Switch Access with
•
Accounting—Collects and sends information used for billing, auditing, and reporting to the
daemon. Network managers can use the accounting facility to track user activity for a
security audit or to provide information for user billing. Accounting records include user identities,
start and stop times, executed commands (such as PPP), number of packets, and number of bytes.
The protocol provides authentication between the switch and the daemon, and it
ensures confidentiality because all protocol exchanges between the switch and the daemon
are encrypted.
You need a system running the daemon software to use on your switch.
Operation
When a user attempts a simple ASCII login by authenticating to a switch using , this process
occurs:
1.
When the connection is established, the switch contacts the daemon to obtain a username
prompt to show to the user. The user enters a username, and the switch then contacts the
daemon to obtain a password prompt. The switch displays the password prompt to the user, the user
enters a password, and the password is then sent to the daemon.
allows a dialog between the daemon and the user until the daemon receives enough
information to authenticate the user. The daemon prompts for a username and password
combination, but can include other items, such as the user’s mother’s maiden name.
2.
The switch eventually receives one of these responses from the daemon:
• ACCEPT—The user is authenticated and service can begin. If the switch is configured to
require authorization, authorization begins at this time.
•
REJECT—The user is not authenticated. The user can be denied access or is prompted to retry
the login sequence, depending on the daemon.
• ERROR—An error occurred at some time during authentication with the daemon or in the
network connection between the daemon and the switch. If an ERROR response is received, the
switch typically tries to use an alternative method for authenticating the user.
•
CONTINUE—The user is prompted for additional authentication information.
After authentication, the user undergoes an additional authorization phase if authorization has been
enabled on the switch. Users must first successfully complete authentication before
proceeding to authorization.
3.
If authorization is required, the daemon is again contacted, and it returns an
ACCEPT or REJECT authorization response. If an ACCEPT response is returned, the response
contains data in the form of attributes that direct the EXEC or NETWORK session for that user and
the services that the user can access:
• Telnet, Secure Shell (SSH), rlogin, or privileged EXEC services
•
Connection parameters, including the host or client IP address, access list, and user timeouts
Configuring
This section describes how to configure your switch to support . At a minimum, you must
identify the host or hosts maintaining the daemon and define the method lists for
authentication. You can optionally define method lists for authorization and accounting. A
method list defines the sequence and methods to be used to authenticate, to authorize, or to keep accounts