Security
20
System Management Guide
3HE 11018 AAAC TQZZA Edition: 01
If any RADIUS server rejects the authentication request, it sends an access reject
message to the router. In this case, no access request is issued to any other RADIUS
servers. However, if other authentication methods such as TACACS+ and/or local
are configured, then these methods are attempted. If no other authentication
methods are configured, or all methods reject the authentication request, then
access is denied.
The user login is successful when the RADIUS server accepts the authentication
request and responds to the router with an access accept message.
Implementing authentication without authorization for the 7705 SAR does not require
the configuration of VSAs (Vendor Specific Attributes) on the RADIUS server.
However, users, user access permissions, and command authorization profiles must
be configured on each router.
Any combination of these authentication methods can be configured to control
network access from a 7705 SAR router:
• Local Authentication
• RADIUS Authentication
• TACACS+ Authentication
3.1.1.1 Local Authentication
Local authentication uses user names and passwords configured on the router to
authenticate login attempts. The user names and passwords are local to each router,
not to user profiles.
By default, local authentication is enabled. When one or more of the other security
methods are enabled, local authentication is disabled. Local authentication is
restored when the other authentication methods are disabled. Local authentication is
attempted if the other authentication methods fail and local is included in the
authentication order password parameters.
Locally, you can configure user names and password management information. This
is referred to as local authentication. Remote security servers such as RADIUS or
TACACS+ are not enabled.
To Next Page
Loading...
