Cisco ASA Series Cli Configuration Manual page 863

Chapter 1 Configuring AAA Servers and the Local Database
Table 1-2 Host Mode Commands, Server Types, and Defaults (continued)
Command
ldap-login-password
ldap-naming-attribute
ldap-over-ssl
ldap-scope
mschapv2-capable
nt-auth-domain-controller NT
radius-common-pw
retry-interval
sasl-mechanism
server-port
server-type
timeout
Examples
Example 1-1
RADIUS group with a single server, and an NT domain server.
Example 1-1
hostname(config)# aaa-server AuthInbound protocol tacacs+
hostname(config-aaa-server-group)# max-failed-attempts 2
hostname(config-aaa-server-group)# reactivation-mode depletion deadtime 20
hostname(config-aaa-server-group)# exit
hostname(config)# aaa-server AuthInbound (inside) host 10.1.1.1
hostname(config-aaa-server-host)# key TACPlusUauthKey
hostname(config-aaa-server-host)# exit
hostname(config)# aaa-server AuthInbound (inside) host 10.1.1.2
Applicable AAA Server
Types
LDAP
LDAP
LDAP
LDAP
RADIUS
RADIUS
Kerberos
RADIUS
SDI
LDAP
Kerberos
LDAP
NT
SDI
TACACS+
LDAP
All
shows how to add one TACACS+ group with one primary and one backup server, one
Multiple AAA Server Groups and Servers
Default Value Description
—
—
636 If not set, the ASA uses sAMAccountName for
LDAP requests. Whether using SASL or plain
text, you can secure communications between
the ASA and the LDAP server with SSL. If you
do not configure SASL, we strongly
recommend that you secure LDAP
communications with SSL.
—
enabled
—
—
10 seconds
10 seconds
10 seconds
—
88
389
139
5500
49
auto-discovery If auto-detection fails to determine the LDAP
server type, and you know the server is either a
Microsoft, Sun or generic LDAP server, you
can manually configure the server type.
10 seconds
Cisco ASA Series CLI Configuration Guide
Configuring AAA
1-17