21-50
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
78-13315-02
Chapter 21 Configuring Switch Access Using AAA
Understanding How Authorization Works
•
EXEC mode (normal login)—When the authorization feature is enabled for EXEC mode, the user
must supply a valid username and password pair to gain access to EXEC mode. Authorization is
required only if you have enabled the authorization feature.
•
Enable mode (privileged login)—When the authorization feature is enabled for enable mode, the
user must supply a valid username and password pair to gain access to enable mode. Authorization
is required only if you have enabled the authorization feature for enable mode.
Primary Options and Fallback Options
You can specify the primary option and fallback option used in the authorization process. Available
options and fallback options include the following:
•
—If you have been authenticated, and there is no response from the server, then
authorization will succeed immediately.
•
deny
—Deny is strictly a fallback option. Authorization will fail if the server fails to
respond. This is the default behavior.
•
if-authenticated
—If you have been authenticated, and there is no response from the
server, then authorization will succeed immediately.
•
none
—Authorization will succeed if the server does not respond.
Command Authorization
You can require authorization for all commands or for configuration (enable mode) commands only.
Configuration commands include the following:
•
copy
•
clear
•
commit
•
configure
•
delete
•
download
•
format
•
reload
•
rollback
•
session
•
set
•
squeeze
•
switch
•
undelete
The following authorization process occurs for every command that you enter:
•
If you have disabled the command authorization feature, the server will allow you to
execute any command on the switch.
