Cisco Catalyst 2960 Сеть Коммутатор Настройка Авторизации Руководство Пользователя PDF (EN)

Prerequisites for Configuring Authorization

Configuring Authorization AAA authorization enables you to limit the services available to a user. When AAA authorization is enabled, the network access server uses information retrieved from the user’s profile, which is located either in the local user database or on the security server, to configure the user’s session. Once this is done, the user will be granted access to a requested service only if the information in the user profile allows it.

Prerequisites for Configuring Authorization, on page 1 Information About Configuring Authorization, on page 2 How to Configure Authorization, on page 5 Configuration Examples for Authorization, on page 8 Feature History for Configuring Authorization, on page 11 Prerequisites for Configuring Authorization Before configuring authorization using named method lists, you must first perform the following tasks: • Enable authentication, authorization, and accounting (AAA) on your network access server. • Configure AAA authentication. Authorization generally takes place after authentication and relies on authentication to work properly.

For more information about AAA authentication, refer to the “Configuring Authentication” module. • Define the characteristics of your RADIUS or TACACS+ security server if you are issuing RADIUS or TACACS+ authorization. For more information about configuring your Cisco network access server to communicate with your RADIUS security server, refer to the chapter “Configuring RADIUS”. For more information about configuring your Cisco network access server to communicate with your TACACS+ security server, refer to the “Configuring TACACS+” module. • Define the rights associated with specific users by using the username command if you are issuing local authorization. Configuring Authorization 1

Стр. 1

AAA Authorization Methods

Information About Configuring Authorization Named Method Lists for Authorization Method lists for authorization define the ways that authorization will be performed and the sequence in which these methods will be performed. A method list is simply a named list describing the authorization methods to be queried (such as RADIUS or TACACS+), in sequence. Method lists enable you to designate one or more security protocols to be used for authorization, thus ensuring a backup system in case the initial method fails.

Cisco IOS XE software uses the first method listed to authorize users for specific network services; if that method fails to respond, the Cisco IOS XE software selects the next method listed in the list. This process continues until there is successful communication with a listed authorization method, or all methods defined are exhausted. Note The Cisco IOS XE software attempts authorization with the next listed method only when there is no response from the previous method.

If authorization fails at any point in this cycle--meaning that the security server or local username database responds by denying the user services--the authorization process stops and no other authorization methods are attempted. Method lists are specific to the authorization type requested: • Commands: Applies to the EXEC mode commands a user issues. Command authorization attempts authorization for all EXEC mode commands, including global configuration commands, associated with a specific privilege level. • EXEC: Applies to the attributes associated with a user EXEC terminal session. • Network: Applies to network connections. This can include a PPP, SLIP, or ARAP connection.

• Reverse Access: Applies to reverse Telnet sessions. When you create a named method list, you are defining a particular list of authorization methods for the indicated authorization type. Once defined, method lists must be applied to specific lines or interfaces before any of the defined methods will be performed. The only exception is the default method list (which is named “default”). If the aaa authorization command for a particular authorization type is issued without a named method list specified, the default method list is automatically applied to all interfaces or lines except those that have a named method list explicitly defined.

(A defined method list overrides the default method list.) If no default method list is defined, local authorization takes place by default. AAA Authorization Methods AAA supports five different methods of authorization: • TACACS+: The network access server exchanges authorization information with the TACACS+ security daemon. TACACS+ authorization defines specific rights for users by associating attribute-value pairs, which are stored in a database on the TACACS+ security server, with the appropriate user. Configuring Authorization Information About Configuring Authorization Configuring Authorization 2

Стр. 2

Authorization Methods

• If-Authenticated: The user is allowed to access the requested function provided the user has been authenticated successfully. • None: The network access server does not request authorization information; authorization is not performed over this line/interface. • Local: The router or access server consults its local database, as defined by the username command, for example, to authorize specific rights for users. Only a limited set of functions can be controlled via the local database. • RADIUS: The network access server requests authorization information from the RADIUS security server.

RADIUS authorization defines specific rights for users by associating attributes, which are stored in a database on the RADIUS server, with the appropriate user. Note With CSCuc32663, passwords and authorization logs are masked before being sent to the TACACS+, LDAP, or RADIUS security servers. Use the aaa authorization commands visible-keys command to send unmasked information to the TACACS+, LDAP, or RADIUS security servers. Authorization Methods To have the network access server request authorization information via a TACACS+ security server, use the aaa authorization command with the group tacacs+ method keyword.

For more specific information about configuring authorization using a TACACS+ security server, refer to the chapter “Configuring TACACS+.” For an example of how to enable a TACACS+ server to authorize the use of network services, including PPP and ARA, see the TACACS Authorization Examples. To allow users to have access to the functions they request as long as they have been authenticated, use the aaa authorization command with the if-authenticated method keyword. If you select this method, all requested functions are automatically granted to authenticated users. There may be times when you do not want to run authorization from a particular interface or line.

To stop authorization activities on designated lines or interfaces, use the none method keyword. If you select this method, authorization is disabled for all actions. To select local authorization, which means that the router or access server consults its local user database to determine the functions a user is permitted to use, use the aaa authorization command with the local method keyword. The functions associated with local authorization are defined by using the username global configuration command.

For a list of permitted functions, refer to the chapter “Configuring Authentication.” To have the network access server request authorization via a RADIUS security server, use the radius method keyword. For more specific information about configuring authorization using a RADIUS security server, refer to the Configuring RADIUS chapter. To have the network access server request authorization via a RADIUS security server, use the aaa authorization command with the group radius method keyword. For more specific information about configuring authorization using a RADIUS security server, refer to the chapter Configuring RADIUS.

For an example of how to enable a RADIUS server to authorize services, see the RADIUS Authorization Example. Configuring Authorization Authorization Methods Configuring Authorization 3

Стр. 3

Authorization Types

Note Authorization method lists for SLIP follow whatever is configured for PPP on the relevant interface. If no lists are defined and applied to a particular interface (or no PPP settings are configured), the default setting for authorization applies. Method Lists and Server Groups A server group is a way to group existing RADIUS or TACACS+ server hosts for use in method lists. The figure below shows a typical AAA network configuration that includes four security servers: R1 and R2 are RADIUS servers, and T1 and T2 are TACACS+ servers. R1 and R2 make up the group of RADIUS servers. T1 and T2 make up the group of TACACS+ servers.

Using server groups, you can specify a subset of the configured server hosts and use them for a particular service. For example, server groups allow you to define R1 and R2 as separate server groups, and T1 and T2 as separate server groups. This means you can specify either R1 and T1 in the method list or R2 and T2 in the method list, which provides more flexibility in the way that you assign RADIUS and TACACS+ resources. Server groups also can include multiple host entries for the same server, as long as each entry has a unique identifier.

The combination of an IP address and a UDP port number creates a unique identifier, allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service. In other words, this unique identifier enables RADIUS requests to be sent to different UDP ports on a server at the same IP address. If two different host entries on the same RADIUS server are configured for the same service--for example, authorization--the second host entry configured acts as fail-over backup to the first one.

Using this example, if the first host entry fails to provide accounting services, the network access server will try the second host entry configured on the same device for accounting services. (The RADIUS host entries will be tried in the order they are configured.) For more information about configuring server groups and about configuring server groups based on DNIS numbers, refer to the chapter Configuring RADIUS or the chapter Configuring TACACS+. AAA Authorization Types Cisco IOS XE software supports five different types of authorization: • Commands: Applies to the EXEC mode commands a user issues.

Command authorization attempts authorization for all EXEC mode commands, including global configuration commands, associated with a specific privilege level. • EXEC: Applies to the attributes associated with a user EXEC terminal session. • Network: Applies to network connections. This can include a PPP, SLIP, or ARAP connection. • Reverse Access: Applies to reverse Telnet sessions. • Configuration: Applies to downloading configurations from the AAA server. • IP Mobile: Applies to authorization for IP mobile services. Authorization Types Named authorization method lists are specific to the indicated type of authorization.

Configuring Authorization Method Lists and Server Groups Configuring Authorization 4

Стр. 4