For example, suppose you want to share the same phone number with several customers, but you want to
know which customer is calling before you pick up the phone. You can customize how you answer the phone
because DNIS allows you to know which customer is calling when you answer.
Cisco devices with either ISDN or internal modems can receive the DNIS number. This functionality allows
users to assign different TACACS+ server groups for different customers (that is, different TACACS+ servers
for different DNIS numbers). Additionally, using server groups you can specify the same server group for
AAA services or a separate server group for each AAA service.
Cisco IOS software provides the flexibility to implement authentication and accounting services in several
ways:
•
Globally--AAA services are defined using global configuration access list commands and applied in
general to all interfaces on a specific network access server.
•
Per interface--AAA services are defined using interface configuration commands and applied specifically
to the interface being configured on a specific network access server.
•
DNIS mapping--You can use DNIS to specify an AAA server to supply AAA services.
Because AAA configuration methods can be configured simultaneously, Cisco has established an order of
precedence to determine which server or groups of servers provide AAA services. The order of precedence
is as follows:
•
Per DNIS--If you configure the network access server to use DNIS to identify which server group
provides AAA services, then this method takes precedence over any additional AAA selection method.
•
Per interface--If you configure the network access server per interface to use access lists to determine
how a server provides AAA services, this method takes precedence over any global configuration AAA
access lists.
•
Globally--If you configure the network access server by using global AAA access lists to determine
how the security server provides AAA services, this method has the lowest precedence.
Prior to configuring AAA Server Group Selection Based on DNIS, you must configure the remote security
servers associated with each AAA server group. See Identifying the TACACS Server Host and Configuring
AAA Server Groups for more information.
Note
To configure the device to select a particular AAA server group based on the DNIS of the server group,
configure DNIS mapping. To map a server group with a group name with DNIS number, use the following
commands in global configuration mode:
SUMMARY STEPS
1.
Device>enable
2.
Device#configure terminal
3.
Device (config)#aaa dnis map enable
4.
Router(config)# aaa dnis map dnis-number authentication ppp group server-group-name
5.
Router(config)# aaa dnis map dnis-number accounting network [none | start-stop | stop-only] group
server-group-name
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
881
Information About TACACS+
To Next Page
Loading...
Need help?
General
