Vty Mac-Sa Filter Support; Role-Based Access Control - Dell S6000–ON Configuration Manual

Hide thumbs Also See for S6000–ON:

Table of Contents

Dell(config-line-vty)#login authentication tacacsmethod

Dell(config-line-vty)#

Dell(config-line-vty)#access-class deny10

Dell(config-line-vty)#end

(same applies for radius and line authentication)

VTY MAC-SA Filter Support

Dell Networking OS supports MAC access lists which permit or deny users based on their source MAC

With this approach, you can implement a security policy based on the source MAC address.

To apply a MAC ACL on a VTY line, use the same access-class command as IP ACLs.

The following example shows how to deny incoming connections from subnet 10.0.0.0 without

displaying a login prompt.

Example of Configuring VTY Authorization Based on MAC ACL for the Line (Per MAC Address)

Dell(conf)#mac access-list standard sourcemac

Dell(config-std-mac)#permit 00:00:5e:00:01:01

Dell(config-std-mac)#deny any

Dell(conf)#line vty 0 9

Dell(config-line-vty)#access-class sourcemac

Dell(config-line-vty)#end

With Role-Based Access Control (RBAC), access and authorization is controlled based on a user's role.

Users are granted permissions based on their user roles, not on their individual user ID. User roles are

created for job functions and through those roles they acquire the permissions to perform their

associated job function.

This chapter consists of the following sections:

Privilege-or-Role Mode Versus Role-only Mode

Configuring Role-based Only AAA Authorization

System-Defined RBAC User Roles

Creating a New User Role

Modifying Command Permissions for Roles

Adding and Deleting Users from a Role

Role Accounting

Configuring AAA Authentication for Roles

Configuring AAA Authorization for Roles

Configuring an Accounting for Roles

Applying an Accounting Method to a Role

Displaying Active Accounting Sessions for Roles

Configuring TACACS+ and RADIUS VSA Attributes for RBAC