Cisco 3560G 48TS Software Configuration Guide - Page 170

Controlling Switch Access with TACACS+ Chapter 8 Configuring Switch-Based Authentication Step 5 Command login authentication {default | list-name} Step 6 Step 7 Step 8 end show running-config copy running-config startup-config Purpose Apply the authentication list to a line or set of lines. • If you specify default, use the default list created with the aaa authentication login command. • For list-name, specify the list created with the aaa authentication login command. Return to privileged EXEC mode. Verify your entries. (Optional) Save your entries in the configuration file. To disable AAA, use the no aaa new-model global configuration command. To disable AAA authentication, use the no aaa authentication login {default | list-name} method1 [method2...] global configuration command. To either disable TACACS+ authentication for logins or to return to the default value, use the no login authentication {default | list-name} line configuration command. Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services AAA authorization limits the services available to a user. When AAA authorization is enabled, the switch uses information retrieved from the user's profile, which is located either in the local user database or on the security server, to configure the user's session. The user is granted access to a requested service only if the information in the user profile allows it. You can use the aaa authorization global configuration command with the tacacs+ keyword to set parameters that restrict a user's network access to privileged EXEC mode. The aaa authorization exec tacacs+ local command sets these authorization parameters: • Use TACACS+ for privileged EXEC access authorization if authentication was performed by using TACACS+. • Use the local database if authentication was not performed by using TACACS+. Note Authorization is bypassed for authenticated users who log in through the CLI even if authorization has been configured. Beginning in privileged EXEC mode, follow these steps to specify TACACS+ authorization for privileged EXEC access and network services: Step 1 Step 2 Command configure terminal aaa authorization network tacacs+ Step 3 aaa authorization exec tacacs+ Step 4 end Purpose Enter global configuration mode. Configure the switch for user TACACS+ authorization for all network-related service requests. Configure the switch for user TACACS+ authorization if the user has privileged EXEC access. The exec keyword might return user profile information (such as autocommand information). Return to privileged EXEC mode. 8-16 Catalyst 3560 Switch Software Configuration Guide 78-16156-01