Configuring Aaa Authentication - Cisco Catalyst 4500 Series Software Configuration Manual

Chapter 52 Configuring Web-Based Authentication

Configuring AAA Authentication

To enable web-based authentication, perform this task:
Command
Step 1
Switch(config)# aaa new-model
Switch(config)# no aaa new-model
Step 2
Switch(config)# aaa authentication login default
group {tacacs+ | radius}
Step 3
Switch(config)# aaa authorization auth-proxy
default group {tacacs+ | radius}
Switch(config)# no aaa authorization auth-proxy
default group {tacacs+ | radius}
Step 4
Switch(config)# tacacs-server host {hostname |
ip_address}
Step 5
Switch(config)# tacacs-server key {key-data}
This example shows how to enable AAA:
Switch(config)# aaa new-model
Switch(config)# aaa authentication login default group tacacs+
Switch(config)# aaa authorization auth-proxy default group tacacs+
Configuring Switch-to-RADIUS-Server Communication
RADIUS security servers are identified by one of the following:
•
•
•
•
The combination of the IP address and UDP port number creates a unique identifier, which enables
RADIUS requests to be sent to multiple UDP ports on a server at the same IP address. If two different
host entries on the same RADIUS server are configured for the same service (for example,
authentication) the second host entry that is configured functions as the failover backup to the first one.
The RADIUS host entries are chosen in the order that they were configured.
To configure the RADIUS server parameters, perform this task:
Command
Step 1
Switch(config)# ip radius source-interface
interface_name
Switch(config)# no ip radius source-interface
Host name
Host IP address
Host name and specific UDP port numbers
IP address and specific UDP port numbers
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Configuring Web-Based Authentication
Purpose
Enables AAA functionality.
Disables AAA functionality.
Defines the list of authentication methods at login.
Creates an authorization method list for web-based
authorization.
Clears the configured method list.
Specifies an AAA server. For RADIUS servers, see the
section "Configuring Switch-to-RADIUS-Server
Communication" section on page
Configures the authorization and encryption key used
between the switch and the TACACS server.
Purpose
Specifies that the RADIUS packets have the IP address of
the indicated interface.
Prevents the RADIUS packets from having the IP address
of the previously indicated interface.
52-9.
52-9