02.10.2013 Views

FTOS Configuration Guide for the C-Series - Force10 Networks

FTOS Configuration Guide for the C-Series - Force10 Networks

FTOS Configuration Guide for the C-Series - Force10 Networks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

VTY Line Remote Au<strong>the</strong>ntication and Authorization<br />

<strong>FTOS</strong> retrieves <strong>the</strong> access class from <strong>the</strong> VTY line.<br />

The <strong>Force10</strong> OS takes <strong>the</strong> access class from <strong>the</strong> VTY line and applies it to ALL users. <strong>FTOS</strong> does not need<br />

to know <strong>the</strong> identity of <strong>the</strong> incoming user and can immediately apply <strong>the</strong> access class. If <strong>the</strong> au<strong>the</strong>ntication<br />

method is radius, TACACS+, or line, and you have configured an access class <strong>for</strong> <strong>the</strong> VTY line, <strong>FTOS</strong><br />

immediately applies it. If <strong>the</strong> access-class is deny all or deny <strong>for</strong> <strong>the</strong> incoming subnet, <strong>FTOS</strong> closes <strong>the</strong><br />

connection without displaying <strong>the</strong> login prompt. Figure 72 shows how to deny incoming connections from<br />

subnet 10.0.0.0 without displaying a login prompt. The example uses TACACS+ as <strong>the</strong> au<strong>the</strong>ntication<br />

mechanism.<br />

Figure 71 Example Access Class <strong>Configuration</strong> Using TACACS+ Without Prompt<br />

<strong>Force10</strong>(conf)#ip access-list standard deny10<br />

<strong>Force10</strong>(conf-ext-nacl)#permit 10.0.0.0/8<br />

<strong>Force10</strong>(conf-ext-nacl)#deny any<br />

<strong>Force10</strong>(conf)#<br />

<strong>Force10</strong>(conf)#aaa au<strong>the</strong>ntication login tacacsmethod tacacs+<br />

<strong>Force10</strong>(conf)#tacacs-server host 256.1.1.2 key <strong>for</strong>ce10<br />

<strong>Force10</strong>(conf)#<br />

<strong>Force10</strong>(conf)#line vty 0 9<br />

<strong>Force10</strong>(config-line-vty)#login au<strong>the</strong>ntication tacacsmethod<br />

<strong>Force10</strong>(config-line-vty)#<br />

<strong>Force10</strong>(config-line-vty)#access-class deny10<br />

<strong>Force10</strong>(config-line-vty)#end<br />

(same applies <strong>for</strong> radius and line au<strong>the</strong>ntication)<br />

Figure 72 Example Access Class <strong>Configuration</strong> Using TACACS+ Without Prompt<br />

VTY MAC-SA Filter Support<br />

<strong>FTOS</strong> supports MAC access lists which permit or deny users based on <strong>the</strong>ir source MAC address. With<br />

this approach, you can implement a security policy based on <strong>the</strong> source MAC address.<br />

To apply a MAC ACL on a VTY line, use <strong>the</strong> same access-class command as IP ACLs (Figure 73).<br />

Figure 73 shows how to deny incoming connections from subnet 10.0.0.0 without displaying a login<br />

prompt. The example uses TACACS+ as <strong>the</strong> au<strong>the</strong>ntication mechanism.<br />

Figure 73 Example Access Class <strong>Configuration</strong> Using TACACS+ Without Prompt<br />

<strong>Force10</strong>(conf)#mac access-list standard sourcemac<br />

<strong>Force10</strong>(config-std-mac)#permit 00:00:5e:00:01:01<br />

<strong>Force10</strong>(config-std-mac)#deny any<br />

<strong>Force10</strong>(conf)#<br />

<strong>Force10</strong>(conf)#line vty 0 9<br />

<strong>Force10</strong>(config-line-vty)#access-class sourcemac<br />

<strong>Force10</strong>(config-line-vty)#end<br />

<strong>FTOS</strong> <strong>Configuration</strong> <strong>Guide</strong>, version 7.7.1.0 157

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!