TACACS+ Authentication
How Authentication Operates
4. When the requesting terminal responds to the prompt with a password,
the switch forwards it to the TACACS+ server and one of the following
actions occurs:
• If the username/password pair received from the requesting
terminal matches a username/password pair previously stored in
the server, then the server passes access permission through the
switch to the terminal.
• If the username/password pair entered at the requesting terminal
does not match a username/password pair previously stored in
the server, access is denied. In this case, the terminal is again
prompted to enter a username and repeat steps 2 through 4. In
the default configuration, the switch allows up to three attempts
to authenticate a login session. If the requesting terminal
exhausts the attempt limit without a successful TACACS+
authentication, the login session is terminated and the operator
at the requesting terminal must initiate a new session before
trying again.
Local Authentication Process
When the switch is configured to use TACACS+, it reverts to local authentica-
tion only if one of these two conditions exists:
■ “Local” is the authentication option for the access method being used.
■ TACACS+ is the primary authentication mode for the access method being
used. However, the switch was unable to connect to any TACACS+ servers
(or no servers were configured) AND Local is the secondary authentica-
tion mode being used.
(For a listing of authentication options, see table 4-2, “Primary/Secondary
Authentication Table” on 4-16.)
For local authentication, the switch uses the operator-level and manager-level
username/password set(s) previously configured locally on the switch. (These
are the usernames and passwords you can configure using the CLI password
command, the web browser interface, or the menu interface—which enables
only local password configuration).
■ If the operator at the requesting terminal correctly enters the username/
password pair for either access level, access is granted.
■ If the username/password pair entered at the requesting terminal does not
match either username/password pair previously configured locally in the
switch, access is denied. In this case, the terminal is again prompted to
enter a username/password pair. In the default configuration, the switch
allows up to three attempts. If the requesting terminal exhausts the
4-25
To Next Page
Loading...
Need help?
General
