Understanding How Authorization Works; Authorization Events; Tacacs+ Primary And Fallback Options - Cisco WS-C2950SX-48-SI Configuration Manual

Chapter 30 Configuring Switch Access Using AAA
Console> (enable) set authentication enable local disable telnet
local enable authentication set to disable for telnet session.
Console> (enable) show tacacs
Tacacs key: tintin_et_milou
Tacacs login attempts: 3
Tacacs timeout: 5 seconds
Tacacs direct request: disabled
Tacacs-Server
----------------------------------------
172.20.52.10
Console> (enable)

Understanding How Authorization Works

The Catalyst 4500 series switch supports TACACS+ and RADIUS authorization to control access to the
switch. Authorization limits access to specified users using a dynamically applied access list (or user
profile) based on the username and password pair. The access list resides on the host running the
TACACS+ or RADIUS server. The server responds to the user password information and applies the
access list.

Authorization Events

You can enable TACACS+ authorization for the following:
•
•
•

TACACS+ Primary and Fallback Options

You can specify the primary and fallback options that are used in the authorization process. The
following primary options and fallback options are available:
•
•
•
•
78-15486-01
Commands—When the authorization feature is enabled for commands, the user must supply a valid
username and password pair to execute certain commands. You can require authorization for all
commands or for configuration (enable mode) commands only. When a user enters a command, the
authorization server receives the command and user information and compares it against an access
list. If the user is authorized to enter that command, the command is executed; otherwise, the
command is not executed.
EXEC mode (normal login)—When the authorization feature is enabled for EXEC mode, the user
must supply a valid username and password pair to access the EXEC mode. Authorization is
required only if you have enabled the authorization feature.
Enable mode (privileged login)—When the authorization feature is enabled for enable mode, the
user must supply a valid username and password pair to access enable mode. Authorization is
required only if you have enabled the authorization feature for enable mode.
tacacs+—If you have been authenticated and there is no response from the TACACS+ server,
authorization succeeds immediately.
if-authenticated—If you have been authenticated and there is no response from the TACACS+
server, authorization succeeds immediately.
none—Authorization succeeds if the TACACS+ server does not respond.
deny—Authorization fails if the TACACS+ server fails to respond. The Deny option is a fallback
option only. This is the default behavior.
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2980G Switches Software Configuration Guide
Understanding How Authorization Works
Status
-------
primary
—
Release 8.1
30-41