Understanding How Authorization Works; Authorization Events - Cisco WS-C2948G-GE-TX Configuration Manual

Understanding How Authorization Works

This example shows how to configure the switch so that TACACS+ authentication is enabled for Telnet
connections and local authentication is enabled for console connections. In addition, a TACACS+
encryption key is specified.
Console> (enable) show tacacs
Tacacs key:
Tacacs login attempts: 3
Tacacs timeout: 5 seconds
Tacacs direct request: disabled
Tacacs-Server
----------------------------------------
Console> (enable) set tacacs server 172.20.52.10
172.20.52.10 added to TACACS server table as primary server.
Console> (enable) set tacacs key tintin_et_milou
The tacacs key has been set to tintin_et_milou.
Console> (enable) set authentication login tacacs enable telnet
tacacs login authentication set to enable for telnet session.
Console> (enable) set authentication enable tacacs enable telnet
tacacs enable authentication set to enable for telnet session.
Console> (enable) set authentication login local disable telnet
local login authentication set to disable for telnet session.
Console> (enable) set authentication enable local disable telnet
local enable authentication set to disable for telnet session.
Console> (enable) show tacacs
Tacacs key: tintin_et_milou
Tacacs login attempts: 3
Tacacs timeout: 5 seconds
Tacacs direct request: disabled
Tacacs-Server
----------------------------------------
172.20.52.10
Console> (enable)
Understanding How Authorization Works
The Catalyst 4500 series switch supports TACACS+ and RADIUS authorization to control access to the
switch. Authorization limits access to specified users using a dynamically applied access list (or user
profile) based on the username and password pair. The access list resides on the host running the
TACACS+ or RADIUS server. The server responds to the user password information and applies the
access list.

Authorization Events

You can enable TACACS+ authorization for the following:
•
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
30-40
Commands—When the authorization feature is enabled for commands, the user must supply a valid
username and password pair to execute certain commands. You can require authorization for all
commands or for configuration (enable mode) commands only. When a user enters a command, the
authorization server receives the command and user information and compares it against an access
list. If the user is authorized to enter that command, the command is executed; otherwise, the
command is not executed.
Chapter 30 Configuring Switch Access Using AAA
Status
-------
Status
-------
primary
78-15908-01