Lenovo Flex System Fabric CN4093, Инструкция по применению

Страница: 105 / 634

© Copyright Lenovo 2017 Chapter 5: Authentication & Authorization Protocols
105
Authentication Features in Enterprise NOS
Authentication is the action of determining the identity of a user, and is generally
done when the user first attempts to log in to a device or gain access to its services.
Enterprise NOS supports ASCII inbound login to the device. PAP, CHAP and
ARAP login methods, change password requests, and one ‐ time
password authentication are not supported.
Authorization
Authorization is the action of determining a user’s privileges on the device, and
usually takes place after authentication.
The default mapping between authorization levels and Enterprise NOS
management access levels is shown in Table 9 . The authorization levels listed in
this table must be defined on the server.
Alternate mapping between authorization levels and Enterprise NOS
management access levels is shown in Table 10 . Use the following command to use
the alternate authorization levels:
You can customize the mapping between privilege levels and CN4093
management access levels. Use the following command to manually map each
privilege level (0 ‐ 15) to a corresponding CN4093 management access
level:
If the remote user is successfully authenticated by the authentication server, the
switch verifies the privileges of the remote user and authorizes the appropriate
access.
Table 9.
Default Authorization Levels
Enterprise NOS User Access
Level
Level
user
0
oper
3
admin (USERID)
6
CN 4093(config) # tacacs-server privilege-mapping
Table 10.
Alternate Authorization Levels
Enterprise NOS User Access
Level
Level
user
0–1
oper
6–8
admin (USERID)
14–15
CN 4093(config)# tacacs-server user-mapping