Hot answers tagged

12

Cisco's IOS uses the different EXEC modes as a basic way to control user privileges. These user privilege controls can be delegated through an enable password, the local user database or AAA (RADIUS, TACACS+). The two EXEC modes are user mode and privileged mode. user EXEC mode> is limited to an array of show commands, basic reachability tests, such as ...


10

exec mode is used for show and debug commands. There are multiple privilege levels associated with exec mode. These command privs (and who can use them) can be managed with Cisco's AAA features. config mode is used to enter configurations from the CLI. Individual config commands can be limited with AAA features. The two modes are useful so you can ...


8

It seems that this line is missing from the c2600... aaa authorization exec default group radius local Exec authorization is what gives a login session the ability to pay attention to priv information from the RADIUS server.


6

The router sends the initial request, and simply waits for a well-formed answer from the Radius/TACACS server. There are no active "keepalive" style health checks; the router doesn't ping the server and look at response-times or anything like that. What the router does next, depends on your configured criteria. In general, once the timeout expires (...


5

The statement aaa authorization exec default group tacacs+ allows you to start a CLI session (a command shell). Without it, you can't get a command prompt. You can see more information here. EDIT: From: http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_cfg_authorizatn.html#...


5

You are authenticating correctly, but the command aaa authorization exec default group tacacs+ local means that in order to start an exec sesion (i.e. a command line shell), the switch will check the Tacacs server for your credentials. Since presumably they're not there, the authorization is failing. It will only use the local database when the Tacacs ...


5

Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely. username localadmin password xyz priv 15 aaa authentication login CONSOLE local aaa authentication login VTY group tacacs+ local aaa authorization exec VTY if-authenticated aaa ...


4

Yes, according to the Cisco documentation (v8.4), you can use a hostname most places you use an IP address. Here's an example lifted from the documentation: ne-asa(config)#aaa-server LDAP_SRV_GRP (inside) host myserver.networkegineering.stackexchage.com ne-asa(config-aaa-server-host)#ldap-attribute-map ne-MAP


4

In general, if you are utilizing Cisco Secure Desktop, this opens up a whole world of options to give you restrictions based on the device. Just as an example off of the top of my head, you could do the following. I haven't had the opportunity to test this configuration, however I have seen similar configurations in the field. Create a Group Policy in AD ...


4

I can sympathize, IOS authentication mechanisms are not simple to understand. The closest command that does what you want is show aaa method-lists authentication. However, this command is not really bullet-proof for the purposes of auditing system login authentication methods. Example usage: For example, let's suppose we have a switch with the following ...


4

This line: aaa authorization exec default local Doesn't allow you to start a shell (Exec) with Radius credentials. You should change it to: aaa authorization exec default group radius local


4

Edited: You use the group tacacs+ for your authentication, but you have not configured a server group for that. Here is a corrected configuration: aaa authentication login default group HQTACACS local aaa authentication enable default group HQTACACS enable aaa authorization commands 0 default group HQTACACS if-authenticated aaa authorization commands 15 ...


3

Yes, this is the exact purpose of the second "a" in "aaa". Authorization is the process of limiting which commands a user is able to execute based on their user/group profile. There are many different products that provide aaa services in a centralized manner, some paid and some free.


3

the default authentication/authorization/accounting list on all lines is named default? Yes, 100% correct; quoting Cisco's docs... Authentication: The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined. Authorization: Once defined, method lists must be applied to specific lines or ...


3

According to the Cisco TAC representative who handled my case, there is no way to get a list of users that includes their last login date, with the possible exception of looking up each user individually. I'm not sure I believe this answer, as it seems like such a basic query that I'd be very surprised if they didn't include any way to get the answer, but ...


3

Basically, the old model was just Authentication with little Authorization and no real Accounting. Maybe you just call it A instead of AAA. :) Searching the Internet has turned up a few references: From Cisco Tips and Tricks: Historically older methods of AAA have revolved around line level passwords and secrets. This leveraged user set passwords on ...


3

I've used FortiGate in the past and you can do that with UTM like M4niac said. One thing to be careful with, maybe you've already experienced this, is Forti units are slow to process changes. In my experience, you do something in the configuration and it takes a couple of minutes before actually applying. Especially when speaking of UTM features. It looks ...


3

What version of fortios are you using? and what model de you have? FortiOs 5.0 and 5.2 (i think) have what are you looking for which includes an UTM options of client reputation (in other words, users rating) not just by traffic, by malware, network applications or IPS. Hope Helps!


3

You need it to source from the inside interface to be included in the interesting traffic over a tunnel. Without specifying that, it will take your default route to get there, which would be your outside interface, and fail. Please add the command ip tacacs source-interface GigabitEthernet0/0/1 on R3 and report back if it is resolved.


3

802.1X provides client-side/front-end port-level authentication (between suplicant and authenticator). RADIUS and Diameter provide back-end authentication (between authenticator and authentication server). Essentially, they are different things. 802.1X is an application while RADIUS/Diameter can potentially provide authentication for various applications. ...


2

The most common way is to segregate access based on group membership. Within ACS there is/should be an "Access Policies" menu - I won't go into every detail of configuring ACS here, because that's why there's a manual, but you can essentially define your policies of which groups members can log in (and which group members have access to run which commands) ...


2

It seems to me that aaa authorization exec default group tacacs+ command forces TACACS+ client(Cisco ISR router in my case) to take account the service = exec configuration snippet in TACACS+ daemon(tac_plus from http://www.shrubbery.net/tac_plus/) configuration file. For example: service = exec { priv-lvl = 15 autocmd = "show version" } If I remove ...


2

Define the local group for the secondary AAA method for authorization, that way if the servers are down it'll use the local priv level for the user account (make sure it's set to 15 for full access) and continue from there.


2

To answer your first question, Yes someone with a wireless sniffer will be able to find your "hidden" SSID by examining probe requests from clients that are already configured to connect to that SSID. Implementing 802.1x can provide the security you are looking for IF it is configured correctly. At the very least you will want to configure your clients to ...


2

Since there's no "vrf mode," I can't see any way to make this happen. You could use ACS to prevent them from entering config mode -- that would give them access to show commands. Presumably that's all they need.


2

After reviewing your configuration it appears that you applied login local only the VTY lines and not the console port. Since you no longer have access to the device you will need to initate a password recovery for the device following the instructions listed here. This will allow you to log into the device and make changes. You will then need to add ...


2

If you are using 802.1x on a cisco switch, you can configure the interface to fallback to an authorized vlan if the server is dead. authentication event server dead action authorize vlan XX authentication event server dead action authorize voice I don't know of any way to cause the switch to "remember" the last authorized vlan.


2

That stands for Authentication, Authorization, and Accounting. It controls who is authorized on a device, what authorization each has, and accounting of who is doing what. Cisco has documents, e.g. Cisco IOS Security Configuration Guide, Release 12.2, that explain what it is and how it works on Cisco devices.


2

Cisco maintains a page with links to the password recovery procedures for a lot of devices: Password Recovery Procedures You will need to restart the switch to get to ROMMON in order to recover the password and fix the configuration, unless you can get in on a VTY or AUX line.


2

You can add the second server to the "SecureID" Server Group as well: aaa-server SecureID (inside) host 10.1.1.2 key ***** authentication-port 1812 accounting-port 1813 Because both AAA Server in the same Server Group (server_tag) there automaticly used for the tunnel-group. See this example from the Cisco CLI Guide: https://www.cisco.com/c/en/us/td/docs/...


Only top voted, non community-wiki answers of a minimum length are eligible