Table of Contents
Advertisement
8 Login Security and RADIUS
Figure 8-4 Example of configuring permission for FTP access
(config)# ftp-server
(config)#
8.1.6 Setting the maximum number of concurrent users
Using the
remote operation terminal. The value of the
configuration command limits the number of remote users who can log in concurrently.
Regardless of this setting, login from the console is always possible. The following setting
example allows no more than two users to be logged in concurrently.
Figure 8-5 Example of setting the maximum number of concurrent users
(config)# line vty 0 1
(config-line)# exit
Switch behavior in regard to concurrent users is as follows:
Multiple users attempting to log in at the same time might not succeed, even if the
number of concurrent users is less than the maximum.
If you change the maximum number of concurrent users, current user sessions will
not be terminated.
8.1.7 Restricting login from remote operation terminals
The settings below enable you to restrict the remote operation terminals that can log in to
the Switch. After performing this setup, make sure that other remote operation terminals
are denied access.
(1) Setting the IP addresses of remote operation terminals permitted to log in
Points to note
If you want to allow only specific remote operation terminals to access the Switch,
you must register the IP addresses of the terminals in advance using the
access-list standard
register IPv4 addresses and subnet masks for which access is permitted by using a
maximum of 16
terminals will be able to access the Switch.
Command examples
1.
(config)# ip access-list standard REMOTE
(config-std-nacl)# deny host 192.168.0.254
(config-std-nacl)# permit 192.168.0.0 0.0.0.255
(config-std-nacl)# exit
Sets the access list
but denies login from IP address 192.168.0.254.
2.
(config)# line vty 0 1
(config-line)# ip access-group REMOTE in
(config-line)# exit
Moves to line mode, applies the access list
network IP address 192.168.0.0/24.
84
line vty
configuration command, you can enable login to the Switch from a
and
ip access-group
REMOTE
<End allocation>
ip access-group
configuration commands. You can
entries. If you omit this setup, all remote operation
, which permits login only from network 192.168.0.0/24
REMOTE
parameter of the
line vty
, and permits login only from the
ip
Advertisement
Table of Contents
