21-51
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
78-13315-02
Chapter 21 Configuring Switch Access Using AAA
Configuring Authorization
•
If you have enabled authorization for configuration commands only, the switch will verify that the
argument string matches one of the commands listed above. If there is no match, the switch
completes the command. If there is a match, the switch forwards the command to the NAS for
authorization.
•
If you have enabled authorization for all commands, the switch forwards the command to the NAS
for authorization.
RADIUS Authorization
RADUIS has limited authorization. There is one attribute, Service-Type, in the authentication protocol
that provides authorization information. This attribute is part of the user-profile.
When you log in using RADIUS authentication and you do not have Administrative/Shell (6)
Service-Type access, the network access server (NAS) authenticates you, and then logs you in to the
EXEC mode. If you have Administrative/Shell (6) Service-Type access, the NAS authenticates you, and
then logs you in to the privileged mode.
Configuring Authorization
These sections describe how to configure authorization:
•
Authorization Default Configuration, page 21-51
•
Authorization Configuration Guidelines, page 21-51
•
Configuring Authorization, page 21-52
•
Configuring RADIUS Authorization, page 21-55
Authorization Default Configuration
Table 21-4
shows the default authorization configuration.
Authorization Configuration Guidelines
Follow these guidelines when configuring authorization on the switch:
•
authorization is disabled by default.
•
Authorization configuration applies to console connections, Telnet connections, or both types of
connections.
Table 21-4
Default Authorization Configuration
Feature
Default Value
login authorization (console and Telnet)
Disabled
EXEC authorization (console and Telnet)
Disabled
enable authorization (console and Telnet)
Disabled
commands authorization (console and Telnet)
Disabled
