Tavve zoneranger User Manual page 135

Cisco ACS servers, beginning with version 5, require a TACACS+ authorization request to
include a Command argument if the Service argument is shell. If the Command box is checked
and a Command argument value is specified, a Command argument with the specified value
will be added to the authorization request. If the Command box is checked and no Command
argument value is specified, an empty Command argument will be added to the authorization
request.
Configuring RADIUS
The Configuration > Access Control page RADIUS tab allows for the configuration of
ZoneRanger RADIUS proxy for authentication of managed nodes as well as RADIUS
authentication on the ZoneRanger itself. At least one Server Group (see Chapter 16) must be
created before RADIUS proxy configuration can be accomplished. RADIUS authentication of
the ZoneRanger itself may be proxied through a Ranger Gateway, which requires at least one
Server Group, or may be configured to communicate directly to a RADIUS server.
Figure 34-21. Configuration > Access Control page RADIUS tab
The Proxy Rules section is used to define which server group is selected for each incoming
RADIUS request.
RADIUS servers depending on an organization's user authentication strategy. For example,
network devices may authenticate to one RADIUS server while servers authenticate to another
RADIUS server. The Source Address field must be IP address and may be an address pattern
or Node Group (see Chapter 2).
RADIUS requests received by a ZoneRanger, and RADIUS responses sent by a ZoneRanger
can be written to a log file, called
the
downloadFile
RADIUS proxy. The log file may also be viewed on the View > Service Logs page. The Log
Levels are:
Log Level
None
Short
Full
ZoneRanger 5.5 User's Guide
Thus, ZoneRanger managed nodes can be organized across multiple
log/radiusProxy.log
command on a Ranger Gateway.
Description
Logging is off
Message header is logged
Entire message is logged
. This log can be downloaded using
This can affect the performance of
135