Hot answers tagged

12

Cisco's IOS uses the different EXEC modes as a basic way to control user privileges. These user privilege controls can be delegated through an enable password, the local user database or AAA (RADIUS, TACACS+). The two EXEC modes are user mode and privileged mode. user EXEC mode> is limited to an array of show commands, basic reachability tests, such as ...


10

exec mode is used for show and debug commands. There are multiple privilege levels associated with exec mode. These command privs (and who can use them) can be managed with Cisco's AAA features. config mode is used to enter configurations from the CLI. Individual config commands can be limited with AAA features. The two modes are useful so you can ...


8

It seems that this line is missing from the c2600... aaa authorization exec default group radius local Exec authorization is what gives a login session the ability to pay attention to priv information from the RADIUS server.


8

This configuration works on our other switches, but it doesn't work on this 4500. You're using the on-board Sup7 FastEthernet port, so this is your problem: aaa authentication login default group tacacs+ local ^^^^^^^^^^^^^ The Sup7 OOB port is in a VRF; therefore, you have to configure Tacacs+ in a VRF aaa new-model ! no ...


6

The router sends the initial request, and simply waits for a well-formed answer from the Radius/TACACS server. There are no active "keepalive" style health checks; the router doesn't ping the server and look at response-times or anything like that. What the router does next, depends on your configured criteria. In general, once the timeout expires (...


5

The statement aaa authorization exec default group tacacs+ allows you to start a CLI session (a command shell). Without it, you can't get a command prompt. You can see more information here. EDIT: From: http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_cfg_authorizatn.html#...


5

You are authenticating correctly, but the command aaa authorization exec default group tacacs+ local means that in order to start an exec sesion (i.e. a command line shell), the switch will check the Tacacs server for your credentials. Since presumably they're not there, the authorization is failing. It will only use the local database when the Tacacs ...


5

If you don't need to confuse your users with multiple VLANs, don't do it. Leverage the tools you have. You mentioned you have ISE and you should be able to do all this with one SSID. As AdnanG already mentioned, you can utilize the profiling features of ISE to classify the devices. Your ACS should be able to tie into the MS AD authentication and be able ...


5

Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely. username localadmin password xyz priv 15 aaa authentication login CONSOLE local aaa authentication login VTY group tacacs+ local aaa authorization exec VTY if-authenticated aaa ...


4

I'm not sure your local device config would be to blame for this, but rather your TACACS server itself. TACACS proxies the username/password prompt from the TACACS server (and possibly an external identity store) to the device, so if you're using ACS (for example) and have it set up to talk to AD to do user authentication, you need to think of the username/...


4

I think your configuration is quite dangerous and you seem indecisive if you are using 'enable/line' or 'local' as fallback, correct answer is local, never use 'enable' and especially never 'line' for anything (line is two-way 'encrypted' not one-way hashed). I would recommend this configuration instead: aaa new-model ! uses tacacs, fallsback to local user ...


4

I would do a debug on your TACACS+ server while you are trying this. I'll assume that you only want to use TACACS authentication and only fall-back to local logins if it can't access the server? Try using this: aaa authentication login default group tacacs+ line aaa authentication enable default group tacacs+ enable Also see this site: It has some good ...


4

In general, if you are utilizing Cisco Secure Desktop, this opens up a whole world of options to give you restrictions based on the device. Just as an example off of the top of my head, you could do the following. I haven't had the opportunity to test this configuration, however I have seen similar configurations in the field. Create a Group Policy in AD ...


4

Yes, according to the Cisco documentation (v8.4), you can use a hostname most places you use an IP address. Here's an example lifted from the documentation: ne-asa(config)#aaa-server LDAP_SRV_GRP (inside) host myserver.networkegineering.stackexchage.com ne-asa(config-aaa-server-host)#ldap-attribute-map ne-MAP


4

I can sympathize, IOS authentication mechanisms are not simple to understand. The closest command that does what you want is show aaa method-lists authentication. However, this command is not really bullet-proof for the purposes of auditing system login authentication methods. Example usage: For example, let's suppose we have a switch with the following ...


4

This line: aaa authorization exec default local Doesn't allow you to start a shell (Exec) with Radius credentials. You should change it to: aaa authorization exec default group radius local


3

the default authentication/authorization/accounting list on all lines is named default? Yes, 100% correct; quoting Cisco's docs... Authentication: The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined. Authorization: Once defined, method lists must be applied to specific lines or ...


3

Yes, this is the exact purpose of the second "a" in "aaa". Authorization is the process of limiting which commands a user is able to execute based on their user/group profile. There are many different products that provide aaa services in a centralized manner, some paid and some free.


3

I've used FortiGate in the past and you can do that with UTM like M4niac said. One thing to be careful with, maybe you've already experienced this, is Forti units are slow to process changes. In my experience, you do something in the configuration and it takes a couple of minutes before actually applying. Especially when speaking of UTM features. It looks ...


3

What version of fortios are you using? and what model de you have? FortiOs 5.0 and 5.2 (i think) have what are you looking for which includes an UTM options of client reputation (in other words, users rating) not just by traffic, by malware, network applications or IPS. Hope Helps!


3

Basically, the old model was just Authentication with little Authorization and no real Accounting. Maybe you just call it A instead of AAA. :) Searching the Internet has turned up a few references: From Cisco Tips and Tricks: Historically older methods of AAA have revolved around line level passwords and secrets. This leveraged user set passwords on ...


3

According to the Cisco TAC representative who handled my case, there is no way to get a list of users that includes their last login date, with the possible exception of looking up each user individually. I'm not sure I believe this answer, as it seems like such a basic query that I'd be very surprised if they didn't include any way to get the answer, but ...


3

You need it to source from the inside interface to be included in the interesting traffic over a tunnel. Without specifying that, it will take your default route to get there, which would be your outside interface, and fail. Please add the command ip tacacs source-interface GigabitEthernet0/0/1 on R3 and report back if it is resolved.


3

802.1X provides client-side/front-end port-level authentication (between suplicant and authenticator). RADIUS and Diameter provide back-end authentication (between authenticator and authentication server). Essentially, they are different things. 802.1X is an application while RADIUS/Diameter can potentially provide authentication for various applications. ...


2

What the last line in your example config does is require level 15 commands to be authorized through tacacs+, or if tacacs+ is not available, to utilize the local database. The previous line requires authorization of level 1 commands through tacacs+ only. It has nothing to do with specifying groups of users.


2

From CCO docs If aaa authorization commands level method command is enabled, all commands, including configuration commands, are authorized by AAA using the method specified. Because there are configuration commands that are identical to some EXEC-level commands, there can be some confusion in the authorization process. Using the no aaa ...


2

The most common way is to segregate access based on group membership. Within ACS there is/should be an "Access Policies" menu - I won't go into every detail of configuring ACS here, because that's why there's a manual, but you can essentially define your policies of which groups members can log in (and which group members have access to run which commands) ...


2

It seems to me that aaa authorization exec default group tacacs+ command forces TACACS+ client(Cisco ISR router in my case) to take account the service = exec configuration snippet in TACACS+ daemon(tac_plus from http://www.shrubbery.net/tac_plus/) configuration file. For example: service = exec { priv-lvl = 15 autocmd = "show version" } If I remove ...


2

To answer your first question, Yes someone with a wireless sniffer will be able to find your "hidden" SSID by examining probe requests from clients that are already configured to connect to that SSID. Implementing 802.1x can provide the security you are looking for IF it is configured correctly. At the very least you will want to configure your clients to ...


2

Define the local group for the secondary AAA method for authorization, that way if the servers are down it'll use the local priv level for the user account (make sure it's set to 15 for full access) and continue from there.


Only top voted, non community-wiki answers of a minimum length are eligible