FTOS Configuration Guide for the C-Series - Force10 Networks

FTOS can assign different access classes to different users by username. Until users attempt to log in,
FTOS does not know if they will be assigned a VTY line. This means that incoming users always see a
login prompt even if you have excluded them from the VTY line with a deny-all access class. Once users
identify themselves, FTOS retrieves the access class from the local database and applies it. (FTOS also
subsequently can close the connection if a user is denied access).
Figure 70 shows how to allow or deny a Telnet connection to a user. Users will see a login prompt, even if
they cannot login. No access class is configured for the VTY line. It defaults from the local database.
Figure 70 Example Access-Class Configuration Using Local Database
Force10(conf)#user gooduser password abc privilege 10 access-class permitall
Force10(conf)#user baduser password abc privilege 10 access-class denyall
Force10(conf)#
Force10(conf)#aaa authentication login localmethod local
Force10(conf)#
Force10(conf)#line vty 0 9
Force10(config-line-vty)#login authentication localmethod
Force10(config-line-vty)#end
Note: See also the section Applying an ACL on Loopback Interfaces on page 348.
156 Security