22.10.2013 Views

7.8.1.0 - Force10 Networks

7.8.1.0 - Force10 Networks

7.8.1.0 - Force10 Networks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Figure 463 demonstrates how to configure the access-class from a TACACS+ server. This causes the<br />

configured access-class on the VTY line to be ignored. If you have configured a deny10 ACL on the<br />

TACACS+ server, FTOS downloads it and applies it. If the user is found to be coming from the 10.0.0.0<br />

subnet, FTOS also immediately closes the Telnet connection. Note, that no matter where the user is coming<br />

from, they see the login prompt.<br />

Figure 463<br />

Specify a TACACS+ server host<br />

<strong>Force10</strong>#<br />

<strong>Force10</strong>(conf)#<br />

<strong>Force10</strong>(conf)#ip access-list standard deny10<br />

<strong>Force10</strong>(conf-ext-nacl)#permit 10.0.0.0/8<br />

<strong>Force10</strong>(conf-ext-nacl)#deny any<br />

<strong>Force10</strong>(conf)#<br />

<strong>Force10</strong>(conf)#aaa authentication login tacacsmethod tacacs+<br />

<strong>Force10</strong>(conf)#aaa authentication exec tacacsauthorization tacacs+<br />

<strong>Force10</strong>(conf)#tacacs-server host 25.1.1.2 key force10<br />

<strong>Force10</strong>(conf)#<br />

<strong>Force10</strong>(conf)#line vty 0 9<br />

<strong>Force10</strong>(config-line-vty)#login authentication tacacsmethod<br />

<strong>Force10</strong>(config-line-vty)#authorization exec tacauthor<br />

<strong>Force10</strong>(config-line-vty)#<br />

<strong>Force10</strong>(config-line-vty)#access-class deny10<br />

<strong>Force10</strong>(config-line-vty)#end<br />

When configuring a TACACS+ server host, you can set different communication parameters, such as the<br />

the key password.<br />

To specify a TACACS+ server host and configure its communication parameters, use the following<br />

command in the CONFIGURATION mode:<br />

Command Syntax Command Mode Purpose<br />

tacacs-server host {hostname |<br />

ip-address} [port port-number]<br />

[timeout seconds] [key key]<br />

CONFIGURATION Enter the host name or IP address of the TACACS+<br />

server host. Configure the optional communication<br />

parameters for the specific host:<br />

• port port-number range: 0 to 65335. Enter a<br />

TCP port number. The default is 49.<br />

• timeout seconds range: 0 to 1000. Default is 10<br />

seconds.<br />

• key key: Enter a string for the key. The key can<br />

be up to 42 characters long. This key must<br />

match a key configured on the TACACS+ server<br />

host. This parameter should be the last<br />

parameter configured.<br />

If these optional parameters are not configured, the<br />

default global values are applied.<br />

To specify multiple TACACS+ server hosts, configure the tacacs-server host command multiple times. If<br />

multiple TACACS+ server hosts are configured, FTOS attempts to connect with them in the order in which<br />

they were configured.<br />

694 Security

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!