Understanding How Authentication Works; Authentication Overview; Understanding How Login Authentication Works - Cisco WS-C6506 Software Manual

Understanding How Authentication Works

Understanding How Authentication Works
These sections describe how the different authentication methods work:
•
•
•
•
•
•
•

Authentication Overview

You can configure any combination of these authentication methods to control access to the switch:
•
•
•
•
•
Kerberos authentication does not work if TACACS+ is used as the authentication method.
Note
When you enable local authentication with one or more other authentication methods, local
authentication is always attempted last. However, you can specify different authentication methods for
the console and Telnet connections. For example, you might use local authentication for the console
connections and RADIUS authentication for the Telnet connections.

Understanding How Login Authentication Works

Login authentication increases the security of the system by keeping the unauthorized users from
guessing the password. The user is limited to a specific number of attempts to successfully log in to the
switch. If the user fails to authorize the password, the system delays the accesses and captures the user
ID and the IP address of the station in the syslog and in the SNMP trap.
The maximum number of login attempts is configurable from the CLI and SNMP through the set
authentication login attempt count command. Enter the set authentication enable attempt count
command to set the login limits for accessing enable mode. The configurable range is three (default) to
ten tries. Setting the login authentication limit to zero (0) disables this function.
All authentication methods are supported (RADIUS, TACACS+, Kerberos, or local).
You can configure the lockout (delay) time from the CLI and SNMP through the set authentication login
lockout time command. Use the set authentication enable lockout time command to set a delay time for
accessing enable mode. The configurable range is 30–43200 seconds. Setting the lockout time to zero (0)
disables this function.
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
39-2
Authentication Overview, page 39-2
Understanding How Login Authentication Works, page 39-2
Understanding How Local Authentication Works, page 39-3
Understanding How Local User Authentication Works, page 39-3
Understanding How TACACS+ Authentication Works, page 39-4
Understanding How RADIUS Authentication Works, page 39-5
Understanding How Kerberos Authentication Works, page 39-5
Login authentication
Local authentication
RADIUS authentication
TACACS+ authentication
Kerberos authentication
Chapter 39 Configuring the Switch Access Using AAA
OL-8978-04