Once set up, the login actions taken by the administrator are the same as with non-RADIUS
authentication and there is almost no indication in the Web Interface or in the CLI that RADIUS is
being used for authentication.
However, there is one exception. When the user credentials are correct but the group name
returned by the RADIUS server does not match any group in the Admin Groups or Audit
Groups, then the Web Interface or CLI will display the following message:
You do not have permission to access this device.
Generated Log Event Messages
Log messages indicate a successful or unsuccessful login by the administrator. With RADIUS
management authentication, the log message will show the following field values:
•
The usergroups field will show a list of all the group memberships returned by the
authenticating RADIUS server. This is often helps in troubleshooting why a user was unable
to successfully login.
•
The access_level indicates the privileges granted for successful authentication.
•
The authsource field will have the value
RADIUS
.
•
The userdb field will have the value of the RADIUS server object name used.
•
The server_ip is the IP of the NetDefendOS interface the client is connecting to. It is not the
IP of the authenticating RADIUS server.
•
The client_ip is the IP of the computer the user is trying to login from.
Below are some typical examples of log event messages:
•
Successful RADIUS Authentication
A successful login with the user being part of the
system_admins
group:
event=admin_login authsystem=HTTP interface=If1 username=jdoe
usergroups=sys_admins access_level=administrator authsource=RADIUS
userdb=radius_auth1 server_ip=192.168.1.1 server_port=80
client_ip=192.168.1.30 client_port=6132
•
Insufficient Access Rights
The user entered a correct username and password but the group name returned by the
RADIUS server (
sys_admins
in the example below) was not found in either the Admin Groups
or Audit Groups lists:
event=admin_authorization_failed action=disallow_admin_access
authsystem=HTTP interface=If1 username=jdoe usergroups=sys_admins
authsource=RADIUS userdb=radius_auth1 server_ip=192.168.1.1
server_port=80 client_ip=192.168.1.30 client_port=6042
•
Servers Unreachable
All configured RADIUS servers were unreachable and a timeout condition occurred:
event=admin_authsource_timeout authsystem=HTTP interface=If1 username=jdoe
Chapter 2: Management and Maintenance
69
Содержание NetDefendOS
Страница 30: ...Figure 1 3 Packet Flow Schematic Part III Chapter 1 NetDefendOS Overview 30 ...
Страница 32: ...Chapter 1 NetDefendOS Overview 32 ...
Страница 144: ...Chapter 2 Management and Maintenance 144 ...
Страница 220: ... Enable DHCP passthrough Enable L2 passthrough for non IP protocols 4 Click OK Chapter 3 Fundamentals 220 ...
Страница 267: ... SourceNetwork lannet DestinationInterface any DestinationNetwork all nets 4 Click OK Chapter 3 Fundamentals 267 ...
Страница 284: ...Chapter 3 Fundamentals 284 ...
Страница 360: ...The ospf command options are fully described in the separate NetDefendOS CLI Reference Guide Chapter 4 Routing 360 ...
Страница 392: ...Chapter 4 Routing 392 ...
Страница 396: ...Web Interface 1 Go to Network Ethernet If1 2 Select Enable DHCP 3 Click OK Chapter 5 DHCP Services 396 ...
Страница 419: ... Host 2001 DB8 1 MAC 00 90 12 13 14 15 5 Click OK Chapter 5 DHCP Services 419 ...
Страница 420: ...Chapter 5 DHCP Services 420 ...
Страница 424: ...2 Now enter Name lan_Access Action Expect Interface lan Network lannet 3 Click OK Chapter 6 Security Mechanisms 424 ...
Страница 573: ...Chapter 6 Security Mechanisms 573 ...
Страница 575: ...This section describes and provides examples of configuring NAT and SAT rules Chapter 7 Address Translation 575 ...
Страница 607: ...Chapter 7 Address Translation 607 ...
Страница 666: ...Chapter 8 User Authentication 666 ...
Страница 775: ...Chapter 9 VPN 775 ...
Страница 819: ...Chapter 10 Traffic Management 819 ...
Страница 842: ...Chapter 11 High Availability 842 ...
Страница 866: ...Default Enabled Chapter 13 Advanced Settings 866 ...
Страница 879: ...Chapter 13 Advanced Settings 879 ...