Configuring Fallback Mechanism For Authentication - Cisco MDS 9000 Series Configuration Manual
Security
Hide thumbs
Also See for MDS 9000 Series:
- Command reference manual (1464 pages) ,
- Configuration manual (344 pages) ,
- Troubleshooting manual (161 pages)
Table of Contents
Configuring Security Features on an External AAA Server
Step 5
switch(config)# aaa authorization commands
Enables AAA authorization for all EXEC mode commands.
Step 6
switch(config)# aaa authorization commands default group tac1
Enables specified TACACS+ server group authorization.
Step 7
switch(config)# aaa authorization commands default group local
Enables default TACACS+ server group authorization.Authorization is based on the local-user-database.
Step 8
switch(config)# no aaa authorization command default group tac1
Removes authorization for a specified function for the authenticated user.
Note
Displays aaa Authorization Information Details
You can use the show commands to display information on the AAA authorization and the default
user roles assigned for remote authentication. (see the following examples)
switch# show aaa authorization all
AAA command authorization:
default authorization for config-commands: local
default authorization for commands: local
cts: group rad1
Displays Default User Role for Remote Authentication
switch# show aaa user default-role
enabled
Configuring Fallback Mechanism for Authentication
You can enable/disable fallback to local database in case the remote authentication is set and all AAA servers
are unreachable (authentication error). The fallback is set to local by default in case of an authentication error.
You can disable this fallback for both console and ssh/telnet login. Disabling this fallback will tighten the
security of authentication.
The CLI syntax and behavior is as follows:
Procedure
Step 1
switch# configure terminal
• Authorization configuration is provided only for authentication done using TACACS+ server.
• The 'none' option from aaa authorization methods has been deprecated. If you did an upgrade
from 4.x image and 'none' was configured as one of the authorization methods, it is be replaced
with local. The functionality remains the same.
• Command authorization disables user role-based authorization control (RBAC), including the
default roles.
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
Configuring Fallback Mechanism for Authentication
37
Chapters
Table of Contents
