Access Profile - Cisco 350XG series Administration Manual

Security
Management Access Method
Cisco 350XG & 550XG Series 10G Stackable Managed Switches
Only users who pass both the active access profile and the management access
authentication methods are given management access to the device.
There can only be a single access profile active on the device at one time.
Access profiles consist of one or more rules. The rules are executed in order of
their priority within the access profile (top to bottom).
Rules are composed of filters that include the following elements:
• Access Methods—Methods for accessing and managing the device:
- Telnet
- Secure Telnet (SSH)
- Hypertext Transfer Protocol (HTTP)
- Secure HTTP (HTTPS)
- Simple Network Management Protocol (SNMP)
- All of the above
• Action—Permit or deny access to an interface or source address.
• Interface—Which ports (including the OOB port), LAGs, or VLANs are
permitted to access or are denied access to the web-based configuration
utility.
• Source IP Address—IP addresses or subnets. Access to management
methods might differ among user groups. For example, one user group
might be able to access the device module only by using an HTTPS
session, while another user group might be able to access the device
module by using both HTTPS and Telnet sessions.

Access Profile

The Access Profiles page displays the access profiles that are defined and
enables selecting one access profile to be the active one.
When a user attempts to access the device through an access method, the device
looks to see if the active access profile explicitly permits management access to
the device through this method. If no match is found, access is denied.
When an attempt to access the device is in violation of the active access profile,
the device generates a SYSLOG message to alert the system administrator of the
attempt.
19
404