Cisco 3560G 48TS Software Configuration Guide - Page 155

CH A P T E R 8 Configuring Switch-Based Authentication This chapter describes how to configure switch-based authentication on the Catalyst 3560 switch. This chapter consists of these sections: • Preventing Unauthorized Access to Your Switch, page 8-1 • Protecting Access to Privileged EXEC Commands, page 8-2 • Controlling Switch Access with TACACS+, page 8-10 • Controlling Switch Access with RADIUS, page 8-18 • Controlling Switch Access with Kerberos, page 8-32 • Configuring the Switch for Local Authentication and Authorization, page 8-36 • Configuring the Switch for Secure Shell, page 8-37 Preventing Unauthorized Access to Your Switch You can prevent unauthorized users from reconfiguring your switch and viewing configuration information. Typically, you want network administrators to have access to your switch while you restrict access to users who dial from outside the network through an asynchronous port, connect from outside the network through a serial port, or connect through a terminal or workstation from within the local network. To prevent unauthorized access into your switch, you should configure one or more of these security features: • At a minimum, you should configure passwords and privileges at each switch port. These passwords are locally stored on the switch. When users attempt to access the switch through a port or line, they must enter the password specified for the port or line before they can access the switch. For more information, see the "Protecting Access to Privileged EXEC Commands" section on page 8-2. • For an additional layer of security, you can also configure username and password pairs, which are locally stored on the switch. These pairs are assigned to lines or ports and authenticate each user before that user can access the switch. If you have defined privilege levels, you can also assign a specific privilege level (with associated rights and privileges) to each username and password pair. For more information, see the "Configuring Username and Password Pairs" section on page 8-7. • If you want to use username and password pairs, but you want to store them centrally on a server instead of locally, you can store them in a database on a security server. Multiple networking devices can then use the same database to obtain user authentication (and, if necessary, authorization) information. For more information, see the "Controlling Switch Access with TACACS+" section on page 8-10. 78-16156-01 Catalyst 3560 Switch Software Configuration Guide 8-1