6-53
Catalyst 2900 Series XL and Catalyst 3500 Series XL Software Configuration Guide
78-6511-08
Chapter 6 Configuring the System
Configuring
The variable list-name is any character string used to name the list you are creating. The method variable
refers to the actual methods the authentication algorithm tries, in the sequence entered. You can choose
one of these methods:
•
line—Uses the line password for authentication. You must define a line password before you can
use this authentication method. Use the password password line configuration command.
•
local—Uses the local username database for authentication. You must enter username information
into the database. Use the username password global configuration command.
•
—Uses authentication. You must configure the server before you can
use this authentication method. For more information, see the
“Configuring the Server
Host” section on page 6-51
.
To create a default list that is used if no list is specified in the login authentication line configuration
command, use the default keyword followed by the methods you want used in default situations.
The additional methods of authentication are used only if the previous method returns an error, not if it
fails. To specify that the authentication succeed even if all methods return an error, specify none as the
final method in the command line.
Specifying Authorization for EXEC Access and Network Services
You can use the aaa authorization global configuration command with the keyword to set
parameters that restrict a user’s network access to Cisco IOS privilege mode (EXEC access) and to
network services such as Serial Line Internet Protocol (SLIP), Point-to-Point Protocol (PPP) with
Network Control Protocols (NCPs), and AppleTalk Remote Access (ARA).
The aaa authorization exec local command sets these authorization parameters:
•
Uses for EXEC access authorization if authentication was done using .
•
Uses the local database if authentication was not done using .
Note
Authorization is bypassed for authenticated users who login through the CLI even if authorization has
been configured.
Beginning in privileged EXEC mode, follow these steps to specify authorization for EXEC
access and network services:
Command
Purpose
Step 1
configure terminal
Enter global configuration mode.
Step 2
aaa authorization network Configure the switch for user authorization for all
network-related service requests.
Step 3
aaa authorization exec
Configure the switch for user authorization to determine if the
user is allowed EXEC access.
The exec keyword might return user profile information (such as
autocommand information).
Step 4
exit
Return to privileged EXEC mode.
