Cisco Configuring Authentication: Полное руководство по настройке аутентификации (EN)

Restrictions for Configuring Authentication

Configuring Authentication Authentication provides a method to identify users, which includes the login and password dialog, challenge and response, messaging support, and encryption, depending on the selected security protocol. Authentication is the way a user is identified prior to being allowed access to the network and network services.

Prerequisites for Configuring Authentication, on page 1 Restrictions for Configuring Authentication, on page 1 Information About Authentication, on page 2 How to Configure Authentication, on page 17 Configuration Examples for Authentication, on page 34 Feature History for Configuring Authentication, on page 47 Prerequisites for Configuring Authentication The implementation of authentication is divided into Authentication, Authorization, and Accounting (AAA) authentication and nonauthentication methods. Cisco recommends that, whenever possible, AAA security services be used to implement authentication.

Restrictions for Configuring Authentication • The number of AAA method lists that can be configured is 250. • If you configure the same RADIUS server IP address for a different UDP destination port for accounting requests by using the acct-port keyword and a UDP destination port for authentication requests by using the auth-port keyword with and without the nonstandard option, the RADIUS server does not accept the nonstandard option. • The aaa accounting delay-start command is not supported for binOS use cases like dot1x authentication. Configuring Authentication 1

Стр. 1

Method Lists and Server Groups

Information About Authentication Named Method Lists for Authentication A named list of authentication methods is first defined before AAA authentication can be configured, and the named list is then applied to various interfaces. The method list defines the types of authentication and the sequence in which they are performed; it must be applied to a specific interface before any of the defined authentication methods are performed. The only exception is the default method list (which is named “default”). The default method list is automatically applied to all interfaces, except those that have a named method list explicitly defined. A defined method list overrides the default method list.

A method list is a sequential list describing the authentication methods to be queried to authenticate a user. Method lists enable you to designate one or more security protocols to be used for authentication, thus ensuring a backup system for authentication in case the initial method fails. Cisco software uses the first listed method to authenticate users. If that method fails to respond, the Cisco software selects the next authentication method listed in the method list. This process continues until there is successful communication with a listed authentication method, or all methods defined in the method list are exhausted.

Note that the software attempts authentication with the next listed authentication method only when there is no response from the previous method. If authentication fails at any point in this cycle, that is, the security server or local username database responds by denying the user access, then the authentication process stops and no other authentication methods are attempted. Method Lists and Server Groups A server group is a way to group existing RADIUS or TACACS+ server hosts for use in method lists. The figure below shows a typical AAA network configuration that includes four security servers: R1 and R2 are RADIUS servers and T1 and T2 are TACACS+ servers.

R1 and R2 make up the group of RADIUS servers. T1 and T2 make up the group of TACACS+ servers. Figure 1: Configuration of a Typical AAA Network This figure shows a typical AAA network configuration. Configuring Authentication Information About Authentication Configuring Authentication 2

Стр. 2

Login Authentication Using Local Password

Using server groups, you can specify a subset of the configured server hosts and use them for a particular service. For example, server groups allow you to define R1 and R2 as a server group, and define T1 and T2 as a separate server group. For example, you can specify R1 and T1 in the method list for authentication login, while specifying R2 and T2 in the method list for PPP authentication. Server groups also can include multiple host entries for the same server, as long as each entry has a unique identifier.

The combination of an IP address and a UDP port number creates a unique identifier, allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service. In other words, this unique identifier enables RADIUS requests to be sent to different UDP ports on a server at the same IP address. If two different host entries on the same RADIUS server are configured for the same service--for example, authentication--the second host entry configured acts as failover backup to the first one.

Using this example, if the first host entry fails to provide accounting services, the network access server will try the second host entry configured on the same device for accounting services. (The RADIUS host entries will be tried in the order in which they are configured.) For more information about configuring server groups and about configuring server groups based on Dialed Number Identification Service (DNIS) numbers, see the “Configuring RADIUS” or “Configuring TACACS+” chapters. Login Authentication Using AAA Login Authentication Using Enable Password Use the aaa authentication login command with the enable keyword to specify the enable password as the login authentication method.

For example, to specify the enable password as the method of user authentication at login when no other method list has been defined, enter the following command: Device(config)# aaa authentication login default enable Before you can use the enable password as the login authentication method, you need to define the enable password. For more information about defining enable passwords, see chapter “Controlling Switch Access with Passwords and Privilege Levels.” Login Authentication Using Line Password Use the aaa authentication login default command with the line keyword to specify the line password as the login authentication method.

For example, to specify the line password as the method of user authentication at login when no other method list has been defined, enter the following command: Device(config)# aaa authentication login default line Before you can use a line password as the login authentication method, you need to define a line password. Login Authentication Using Local Password Use the aaa authentication login default command with the local keyword to specify that the Cisco device will use the local username database for authentication. For example, to specify the local username database as the method of user authentication at login when no other method list has been defined, enter the following command:

Device(config)# aaa authentication login default local Configuring Authentication Login Authentication Using AAA Configuring Authentication 3

Стр. 3

Login Authentication Using Group Name

Login Authentication Using Group RADIUS Use the aaa authentication login default command with the group radius to specify RADIUS as the login authentication method. For example, to specify RADIUS as the method of user authentication at login when no other method list has been defined, enter the following command: Device(config)# aaa authentication login default group radius Before you can use RADIUS as the login authentication method, you need to enable communication with the RADIUS security server.

For more information about establishing communication with a RADIUS server, refer to the chapter “Configuring RADIUS.” RADIUS Attribute 8 in Access Requests After you have used the aaa authentication login command to specify RADIUS and your login host has been configured to request its IP address from the NAS, you can send attribute 8 (Framed-IP-Address) in access-request packets by using the radius-server attribute 8 include-in-access-req command in global configuration mode. This command makes it possible for NAS to provide the RADIUS server a hint of the user IP address in advance for user authentication.

Login Authentication Using Group TACACS Use the aaa authentication login default command with the group tacacs+ to specify TACACS+ as the login authentication method. For example, to specify TACACS+ as the method of user authentication at login when no other method list has been defined, enter the following command: Device(config)# aaa authentication login default group tacacs+ Before you can use TACACS+ as the login authentication method, you need to enable communication with the TACACS+ security server.

For more information about establishing communication with a TACACS+ server, refer to the chapter “Configuring TACACS+.” If the ip radius source interface command is configured under the group, the MTU of the source interface is used for injecting the packet. And if not configured, default fragmentation at 1396 bytes is done. Note Login Authentication Using Group Name Use the aaa authentication login default command with the group group-name method to specify a subset of RADIUS or TACACS+ servers to use as the login authentication method. To specify and define the group name and the members of the group, use the aaa group server command.

For example, use the aaa group server command to first define the members of group loginrad : Device> enable Device# configure terminal Device(config)# aaa group server radius loginrad Device(config-sg-radius)# server 172.16.2.3 Device(config-sg-radius)# server 172.16.2 17 Device(config-sg-radius)# server 172.16.2.32 Device(config-sg-radius)# end This command specifies RADIUS servers 172.16.2.3, 172.16.2.17, and 172.16.2.32 as members of the group loginrad . To specify group loginrad as the method of user authentication at login when no other method list has been defined, enter the following command:

Configuring Authentication Login Authentication Using Group RADIUS Configuring Authentication 4

Стр. 4