Cisco MGX 8830, Руководство по настройке

Страница: 432 / 642

9-68
Cisco MGX 8850 (PXM1E/PXM45), Cisco MGX 8950, Cisco MGX 8830, and Cisco MGX 8880 Configuration Guide
Release 5.0.10, OL-3845-01 Rev. B0, August 16, 2004
Chapter 9 Switch Operating Procedures
Managing Remote () Authentication and Authorization
You can select multiple authentication methods. When a user attempts to authenticate, the switch uses
the authenticated methods in the configured order. If the first method attempted fails to get a pass or fail
for the user, the next method is attempted. For example, if the configured methods are “ local”
and no servers are available, the switch will use the local database to authenticate users.
When is used for authentication, it is not very practical to use the local database for a backup.
A prime advantage of the method is that you do not have to configure users in the local
database on every switch. When the configuration uses the local database for backup, user data must be
entered into the AAA server at every switch in the network, and updates must be manually synchronized
on the switch and server. A more practical approach is to establish fault tolerance by setting up multiple
AAA servers.
The cisco method listed in Table 9-30 is always enabled and is the last authentication method attempted
if it is not configured before the local or methods. This ensures that the user cisco can access
the switch when the AAA servers are unavailable.
To configure authentication, log in using a username with SERVICE_GP privileges or higher and enter
the cnfaaa-authen command using the following format:
M8850_LA.7.PXM.a > cnfaaa-authen < method > [< method >...]
Replace the method variables with one of the keywords listed in Table 9-30 . The first method after the
command name is the preferred method. You can enter up to three methods. The second method is used
when the first method does not produce a pass or fail, and the third method is used when the second
method cannot authenticate the user.
Note If you enter the cnfaaa-authen command and specify the method, and if no AAA servers are
configured, the command will fail. Configure AAA servers with the cnfaaa-server command before you
configure authentication.
Table 9-30 Keywords for cnfaaa_authen and cnfaaa-author Commands
Keyword Description
cisco The cisco keyword selects the local database for authentication or
authorization and limits access only to the user cisco.
Note User cisco access method is always enabled and is used for
authentication and authorization when all other methods fail. However,
you can configure the user cisco access method to have a higher
priority than other authentication or authorization methods.
default The default keyword selects the local (on the switch) database for
authentication or authorization. This keyword produces the same result as the
local keyword.
When this method is chosen for authorization (which is described in the next
section), it is only valid for group mode.
local The local keyword selects the local database for authentication or
authorization.
When this method is chosen for authorization, it is only valid for group mode.
The keyword selects authentication or authorization through
protocol communications with an AAA server.