Access Authentication Control - D-Link xStack DES-3800 Series User Manual

Use the Security IP Management to permit remote stations to manage the Switch. If you choose to
define one or more designated management stations, only the chosen stations, as defined by IP
address, will be allowed management privilege through the web manager or Telnet session. To define
a management station IP setting, type in the IP address and click the Apply button.

Access Authentication Control

The TACACS/XTACACS/TACACS+/RADIUS commands let you secure access to the Switch using
the TACACS/XTACACS/TACACS+/RADIUS protocols. When a user logs in to the Switch or tries to
access the administrator level privilege, he or she is prompted for a password. If
TACACS/XTACACS/TACACS+/RADIUS authentication is enabled on the Switch, it will contact a
TACACS/XTACACS/TACACS+/RADIUS server to verify the user. If the user is verified, he or she
is granted access to the Switch.
There are currently three versions of the TACACS security protocol, each a separate entity. The
Switch's software supports the following versions of TACACS:
TACACS (Terminal Access Controller Access Control System) - Provides password
•
checking and authentication, and notification of user actions for security purposes utilizing
via one or more centralized TACACS servers, utilizing the UDP protocol for packet
transmission.
Extended TACACS (XTACACS) - An extension of the TACACS protocol with the ability
•
to provide more types of authentication requests and more types of response codes than
TACACS. This protocol also uses UDP to transmit packets.
TACACS+ (Terminal Access Controller Access Control System plus) - Provides detailed
•
access control for authentication for network devices. TACACS+ is facilitated through
Authentication commands via one or more centralized servers. The TACACS+ protocol
encrypts all traffic between the Switch and the TACACS+ daemon, using the TCP protocol to
ensure reliable delivery
In order for the TACACS/XTACACS/TACACS+/RADIUS security function to work properly, a
TACACS/XTACACS/TACACS+/RADIUS server must be configured on a device other than the
Switch, called an Authentication Server Host and it must include usernames and passwords for
authentication. When the user is prompted by the Switch to enter usernames and passwords for
authentication, the Switch contacts the TACACS/XTACACS/TACACS+/RADIUS server to verify,
and the server will respond with one of three messages:
xStack DES-3800 Series Layer 3 Stackable Fast Ethernet Managed Switch
Figure 11- 14. Security IP Management window
213