Dell MX9116n EMC SmartFabric OS10 User Guide - Page 932

Restrict SNMP access To filter SNMP requests on the switch, assign access lists to an SNMP community. Both IPv4 and IPv6 access lists are supported. 1. Create access lists with permit or deny filters; for example: OS10(config)# ip access-list snmp-read-only-acl OS10(config-ipv4-acl)# permit ip 172.16.0.0 255.255.0.0 any OS10(config-ipv4-acl)# exit OS10(config)# 2. Apply ACLs to an SNMP community in CONFIGURATION mode. OS10(config)# snmp-server community public ro acl snmp-read-only-acl View SNMP ACL configuration OS10# show snmp community Community : public Access : read-only ACL : snmp-read-only-acl Enable AAA accounting To record information about all user-entered commands, use the AAA accounting feature - not supported for RADIUS accounting. AAA accounting records login and command information in OS10 sessions on console connections using the console option and remote connections using the default option, such as Telnet and SSH. AAA accounting sends accounting messages: • Sends a start notice when a process begins, and a stop notice when the process ends using the start-stop option • Sends only a stop notice when a process ends using the stop-only option • No accounting notices are sent using the none option • Logs all accounting notices in syslog using the logging option • Logs all accounting notices on configured TACACS+ servers using the group tacacs+ option Enable AAA accounting • Enable AAA accounting in CONFIGURATION mode. aaa accounting commands all {console | default} {start-stop | stop-only | none} [logging] [group tacacs+] The no version of this command disables AAA accounting. Enable user lockout By default, a maximum of three consecutive failed password attempts is supported on the switch. You can set a limit to the maximum number of allowed password retries with a specified lockout period for the user ID. This feature is available only for the sysadmin and secadmin roles. • Configure user lockout settings in CONFIGURATION mode. password-attributes {[max-retry number ] [lockout-period minutes]} • max-retry number - Sets the maximum number of consecutive failed login attempts for a user before the user is locked out, from 0 to 16; default 3. • lockout-period minutes - Sets the amount of time that a user ID is prevented from accessing the system after exceeding the maximum number of failed login attempts, from 0 to 43,200; default 0. When a user is locked out due to exceeding the maximum number of failed login attempts, other users can still access the switch. By default, lockout-period minutes is 0; no lockout period is configured. Failed login attempts do not lock out a user. 932 Security