Home » Dell Manuals » Hubs & Switches » Dell N3200-ON » Manual Viewer

Dell N3200-ON EMC Networking N-Series Switches User Guide version 6.6.3 - Page 347

TACACS+ Authorization Example-Per-command Authorization

Get Dell N3200-ON PDF manuals and user guides

Add to My Manuals
Save this manual to your list of manuals

Page 347 highlights

TACACS+ Authorization Example-Per-command Authorization An alternative method for command authorization is to use the TACACS+ feature of per-command authorization. With this feature, every time the user enters a command, a request is sent to the TACACS+ server to ask if the user is permitted to execute that command. Exec authorization does not need to be configured to use per-command authorization. Apply the following configuration to use TACACS+ to authorize commands: 1 Creates a command authorization method list called "taccmd" that includes the method tacacs. console#config console(config)#aaa authorization commands "taccmd" tacacs • Assigns the taccmd command authorization method list to be used for users accessing the switch via Telnet. console(config)#line telnet console(config-telnet)#authorization commands taccmd console(config-telnet)#exit The TACACS+ server must be configured with the commands that the user is allowed to execute. If the server is configured for command authorization as "None", then no commands will be authorized. If both administrative profiles and per-command authorization are configured for a user, any command must be permitted by both the administrative profiles and by percommand authorization. TACACS Authorization-Privilege Level Dell EMC Networking TACACS supports setting the maximum user privilege level in the TACACS authorization response. Configure the TACACS server to send priv-lvl=X, where X is either 1 (Non-privileged mode), or 15 (Privileged Exec mode). Authentication, Authorization, and Accounting 347

Section	Page
Introduction	55
About This Document	55
Audience	56
Document Conventions	56
Additional Documentation	57
Switch Feature Overview	59
System Management Features	60
Multiple Management Options	60
System Time Management	60
Log Messages	61
System Reset	61
Integrated DHCP Server	61
Management of Basic Network Information	62
IPv6 Management Features	62
Dual Software Images	62
File Management	63
Switch Database Management Templates	63
Automatic Installation of Firmware and Configuration	63
sFlow	64
SNMP Alarms and Trap Logs	64
CDP Interoperability Through ISDP	65
Remote Monitoring (RMON)	65
Stacking Features	65
Mixed and Single Series Stacking	65
Single IP Management	66
Master Failover with Transparent Transition	67
Nonstop Forwarding on the Stack	67
Hot Add/Delete and Firmware Synchronization	67
Security Features	68
Configurable Access and Authentication Profiles	68
Password-Protected Management Access	68
Strong Password Enforcement	68
TACACS+ Client	68
RADIUS Support	69
SSH/SSL	69
Inbound Telnet Control	69
Denial of Service	69
Port Protection	70
Captive Portal	71
802.1X Authentication (IEEE 802.1X)	71
MAC-Based 802.1X Authentication	72
802.1X Monitor Mode	72
Port Security	73
Access Control Lists (ACLs)	73
Time-Based ACLs	73
IP Source Guard (IPSG)	74
DHCP Snooping	74
Dynamic ARP Inspection	74
Protected Ports (Private VLAN Edge)	74
Green Technology Features	75
Energy Detect Mode	75
Energy Efficient Ethernet	75
Power Utilization Reporting	76
Power over Ethernet (PoE) Features	76
PD Detection	76
Legacy (Reduced Capacitor) Detection	76
Classification	77
Port Start Up	77
Overload Detection and Port Shutdown	77
Disconnect Detection	77
IC Thermal Monitoring	77
Over-Temperature Protection	78
4-Pair Ports	78
IEEE 802.3bt Capability	79
PoE Port Capabilities and Power Limits	80
Key PoE Plus Features	82
Power Over Ethernet (PoE) Support	83
PoE Plus Support	83
PoE 60W Support	83
Powered Device Detection	84
PoE Power Management Modes	84
Power Management in Guard Band	86
PoE Plus Default Settings	88
Switching Features	89
Flow Control Support (IEEE 802.3x)	89
Head of Line Blocking Prevention	89
Jumbo Frames Support	89
Auto-MDI/MDIX Support	89
VLAN-Aware MAC-based Switching	89
Back Pressure Support	90
Auto-negotiation	90
Storm Control	90
Port Mirroring	91
Static and Dynamic MAC Address Tables	91
Link Layer Discovery Protocol (LLDP)	91
Link Layer Discovery Protocol (LLDP) for Media Endpoint Devices	92
Connectivity Fault Management (IEEE 802.1ag)	93
Cisco Protocol Filtering	93
DHCP Layer-2 Relay	93
Virtual Local Area Network Supported Features	94
VLAN Support	94
Port-Based VLANs	94
IP Subnet-based VLAN	94
MAC-based VLAN	94
IEEE 802.1v Protocol-Based VLANs	94
Voice VLAN	95
GARP and GVRP Support	95
Guest VLAN	95
Unauthorized VLAN	95
Double VLANs	95
Spanning Tree Protocol Features	97
Spanning Tree Protocol (STP)	97
Spanning Tree Port Settings	97
Rapid Spanning Tree	97
Multiple Spanning Tree	97
Bridge Protocol Data Unit (BPDU) Guard	98
BPDU Filtering	98
RSTP-PV and STP-PV	98
Link Aggregation Features	99
Link Aggregation	99
Link Aggregate Control Protocol (LACP)	100
Multi-Switch LAG (MLAG)	100
Routing Features	101
Address Resolution Protocol (ARP) Table Management	101
VLAN Routing	101
IP Configuration	101
Open Shortest Path First (OSPF)	102
Border Gateway Protocol (BGP)	102
Virtual Routing and Forwarding (VRF)	102
BOOTP/DHCP Relay Agent	103
IP Helper and DHCP Relay	103
Routing Information Protocol	103
Router Discovery	103
Routing Table	103
Virtual Router Redundancy Protocol (VRRP)	104
Tunnel and Loopback Interfaces	104
IPv6 Routing Features	105
IPv6 Configuration	105
IPv6 Routes	105
OSPFv3	105
DHCPv6	105
Quality of Service (QoS) Features	106
Differentiated Services (DiffServ)	106
Class Of Service (CoS)	106
Auto Voice over IP (VoIP)	106
Internet Small Computer System Interface (iSCSI) Optimization	107
Layer-2 Multicast Features	107
MAC Multicast Support	107
IGMP Snooping	107
IGMP Snooping Querier	108
MLD Snooping	108
Multicast VLAN Registration	108
Layer-3 Multicast Features	109
Distance Vector Multicast Routing Protocol	109
Internet Group Management Protocol	109
IGMP Proxy	109
Protocol Independent Multicast—Dense Mode	109
Protocol Independent Multicast—Sparse Mode	110
Protocol Independent Multicast—Source Specific Multicast	110
Protocol Independent Multicast IPv6 Support	110
MLD/MLDv2 (RFC2710/RFC3810)	110
Hardware Overview	111
Dell EMC Networking N1100-ON Series Switch Hardware	111
N1100-ON Series Front Panel	111
N1100-ON Series Power Supply	114
N1100-ON Series Ventilation System	114
N1100-ON Series Thermal Shutdown	114
N1100-ON Series LED Definitions	114
Power Consumption for N1100-ON Series PoE Switches	118
N1100-ON Series Wall Installation	119
Dell EMC Networking N1500 Series Switch Hardware	121
N1500 Series Front Panel	121
N1500 Series Back Panel	124
N1500 Series LED Definitions	126
Power Consumption for N1500 Series PoE Switches	128
Dell EMC Networking N2000 Series Switch Hardware	129
N2000 Series Front Panel	130
N2000 Series Back Panel	133
N2000 Series LED Definitions	135
Power Consumption for N2000 Series PoE Switches	138
Dell EMC Networking N2100-ON Series Switch Hardware	140
N2100-ON Series Front Panel	140
N2100-ON Series Back Panel	142
N2100-ON Series LED Definitions	142
Power Consumption for N2100-ON Series PoE Switches	146
Dell EMC Networking N2200-ON Series Switch Hardware	149
N2200-ON Series Front Panel	149
N2200-ON Series Rear Panel	149
N2200X-ON Series Switch Ports	150
N2200-ON Series Console Port	151
N2200-ON Series USB Port	152
N2200-ON Series Reset Button	152
N2200-ON Series Port and System LEDs	152
N2200-ON Series Stack Master LED and Stack Number Display	152
N2200-ON Series Power Supplies	153
N2200-ON Series LED Definitions	154
Dell EMC Networking N3000E-ON Series Switch Hardware	158
Front Panel	158
Back Panel	164
LED Definitions	166
Power Consumption for PoE Switches	171
Dell EMC Networking N3100-ON Series Switch Hardware	173
N3100-ON Series Front Panel	173
N3100-ON Series Back Panel	175
N3100-ON Series LED Definitions	175
Power Consumption for N3100-ON Series PoE Switches	180
Dell EMC Networking N3200-ON Series Switch Hardware	183
N3200-ON Series Front Panel	183
N3200-ON Series Rear Panel	183
N3200-ON Series Switch Ports	184
N3200-ON Series Console Port	185
N3200-ON Series USB Port	186
N3200-ON Series Reset Button	186
N3200-ON Series Port and System LEDs	187
N3200-ON Series Stack Master LED and Stack Number Display	187
N3200-ON Series Power Supplies	187
N3200-ON Series LED Definitions	188
Switch MAC Addresses	201
Using Dell EMC OpenManage Switch Administrator	203
About Dell EMC OpenManage Switch Administrator	203
Starting the Application	204
Understanding the Interface	205
Using the Switch Administrator Buttons and Links	207
Defining Fields	208
Understanding the Device View	208
Using the Device View Port Features	208
Using the Device View Switch Locator Feature	209
Using the Command-Line Interface	211
Accessing the Switch Through the CLI	211
Console Connection	211
Telnet Connection	212
Understanding Command Modes	213
Entering CLI Commands	215
Using the Question Mark to Get Help	215
Using Command Completion	216
Entering Abbreviated Commands	216
Negating Commands	216
Command Output Paging	216
Understanding Error Messages	217
Recalling Commands from the History Buffer	217
Default Settings	219
Setting the IP Address and Other Basic Network Information	223
IP Address and Network Information Overview	223
What Is the Basic Network Information?	223
Why Is Basic Network Information Needed?	224
How Is Basic Network Information Configured?	225
What Is Out-of-Band Management and In-Band Management?	225
Default Network Information	228
Configuring Basic Network Information (Web)	229
Out-of-Band Interface	229
IP Interface Configuration (Default VLAN IP Address)	230
Route Entry Configuration (Switch Default Gateway)	232
Domain Name Server	234
Default Domain Name	235
Host Name Mapping	236
Dynamic Host Name Mapping	237
Configuring Basic Network Information (CLI)	238
Enabling the DHCP Client on the OOB Port	238
Enabling the DHCP Client on the Default VLAN	238
Managing DHCP Leases	239
Configuring Static Network Information on the OOB Port	240
Configuring Static Network Information on the Default VLAN	241
Configuring and Viewing Additional Network Information	242
Basic Network Information Configuration Examples	244
Configuring Network Information Using the OOB Port	244
Configuring Network Information Using the Serial Interface	246
Stacking	249
Stacking Overview	249
Dell EMC Networking Stacking Compatibility	253
How is the Stack Master Selected?	254
Adding a Switch to the Stack	255
Removing a Switch from the Stack	256
How is the Firmware Updated on the Stack?	257
What is Stacking Standby?	257
What is Nonstop Forwarding?	258
Switch Stack MAC Addressing and Stack Design Considerations	261
NSF Network Design Considerations	261
Why is Stacking Needed?	262
Default Stacking Values	262
Managing and Monitoring the Stack (Web)	264
Unit Configuration	264
Stack Summary	265
Stack Firmware Synchronization	266
Supported Switches	267
Stack Port Summary	268
Stack Port Counters	269
Stack Port Diagnostics	269
NSF Summary	270
Checkpoint Statistics	271
Managing the Stack (CLI)	272
Configuring Stack Member, Stack Port, SFS and NSF Settings	272
Viewing and Clearing Stacking and NSF Information	274
Connecting to the Management Console from a Stack Member	275
Stacking and NSF Usage Scenarios	275
Basic Failover	275
Preconfiguring a Stack Member	277
NSF in the Data Center	279
NSF and VoIP	280
NSF and DHCP Snooping	281
NSF and the Storage Access Network	282
NSF and Routed Access	284
Authentication, Authorization, and Accounting	287
AAA Introduction	287
Methods	288
Method Lists	289
Access Lines	290
Enabling SSH Access	291
Access Lines (AAA)	291
Access Lines (Non-AAA)	292
Authentication	293
Authentication Access Types	293
Authentication Manager	294
Using RADIUS	303
Using TACACS+	308
Dynamic ACL Overview	310
Authentication Examples	317
Public Key SSH Authentication Example	325
Associating a User With an SSH Key	334
Authorization	336
Exec Authorization Capabilities	336
Authorization Examples	338
RADIUS Change of Authorization	340
TACACS Authorization	344
Accounting	348
RADIUS Accounting	348
IEEE 802.1X	351
What is IEEE 802.1X?	351
What are the 802.1X Port Authentication Modes?	352
What are Authentication Host Modes	353
What is MAC Authentication Bypass?	354
What is the Role of 802.1X in VLAN Assignment?	356
What is Monitor Mode?	360
How Does the Authentication Server Assign DiffServ Policy or ACLs?	362
What is the Internal Authentication Server?	362
Default 802.1X Values	363
Configuring IEEE 802.1X (Web)	364
Captive Portal	388
Captive Portal Overview	388
Default Captive Portal Behavior and Settings	396
Configuring Captive Portal (Web)	398
Configuring Captive Portal (CLI)	414
Captive Portal Configuration Example	420
In Case Of Problems in Captive Portal Deployment	424
Monitoring and Logging System Information	425
System Monitoring Overview	425
What System Information Is Monitored?	425
Why Is System Information Needed?	426
Where Are Log Messages Sent?	426
What Are the Severity Levels?	427
What Are the System Startup and Operation Logs?	427
What Is the Log Message Format?	428
What Factors Should Be Considered When Configuring Logging?	430
Default Log Settings	431
Monitoring System Information and Configuring Logging (Web)	432
Device Information	432
System Health	434
System Resources	435
Unit Power Usage History	436
Integrated Cable Test for Copper Cables	437
Optical Transceiver Diagnostics	438
Log Global Settings	439
RAM Log	440
Log File	442
SYSLOG Server	442
Email Alert Global Configuration	445
Email Alert Mail Server Configuration	445
Email Alert Subject Configuration	447
Email Alert To Address Configuration	448
Email Alert Statistics	448
Monitoring System Information and Configuring Logging (CLI)	450
Viewing System Information and Enabling the Locator LED	450
Running Cable Diagnostics	450
Configuring Local Logging	452
Configuring Remote Logging	453
Configuring Mail Server Settings	454
Configuring Email Alerts for Log Messages	455
Logging Configuration Examples	457
Configuring Local and Remote Logging	457
Configuring Email Alerting	460
Managing General System Settings	463
System Settings Overview	463
Why Does System Information Need to Be Configured?	464
What Are SDM Templates?	465
Why is the System Time Needed?	468
How Does SNTP Work?	468
What Configuration Is Required for Plug-In Modules?	469
Default General System Information	469
Configuring General System Settings (Web)	470
System Information	470
CLI Banner	473
SDM Template Preference	474
Clock	475
SNTP Global Settings	476
SNTP Authentication	477
SNTP Server	479
Summer Time Configuration	482
Time Zone Configuration	483
Card Configuration	484
Slot Summary	485
Supported Cards	486
Power Over Ethernet Global Configuration	487
Power Over Ethernet Unit Configuration	488
Power Over Ethernet Interface Configuration	489
Configuring System Settings (CLI)	491
Configuring System Information	491
Configuring the Banner	492
Managing the SDM Template	493
Configuring SNTP Authentication and an SNTP Server	493
Setting the System Time and Date Manually	495
Configuring the Expansion Slots	496
Viewing Slot Information	497
Configuring PoE Settings	497
General System Settings Configuration Examples	499
Configuring System and Banner Information	499
Configuring SNTP	502
Configuring the Time Manually	504
SNMP	505
SNMP Overview	505
What Is SNMP?	505
What Are SNMP Traps?	506
Why Is SNMP Needed?	507
Default SNMP Values	507
Configuring SNMP (Web)	509
SNMP Global Parameters	509
SNMP View Settings	510
Access Control Group	512
SNMPv3 User Security Model (USM)	514
Communities	517
Notification Filter	519
Notification Recipients	520
Trap Flags	522
OSPFv2 Trap Flags	523
OSPFv3 Trap Flags	524
Trap Log	525
Configuring SNMP (CLI)	527
Configuring the SNMPv3 Engine ID	527
Configuring SNMP Views, Groups, and Users	528
Configuring Communities	531
Configuring SNMP Notifications (Traps and Informs)	533
SNMP Configuration Examples	536
Configuring SNMPv1 and SNMPv2	536
Configuring SNMP Management Station Access	537
Configuring SNMPv3	538
Images and File Management	543
Image and File Management Overview	543
What Files Can Be Managed?	543
Why Is File Management Needed?	545
What Methods Are Supported for File Management?	548
What Factors Should Be Considered When Managing Files?	549
How Is the Running Configuration Saved?	552
Managing Images and Files (Web)	553
File System	553
Active Images	554
USB Flash Drive	555
File Download	556
File Upload	558
Copy Files	560
Managing Images and Files (CLI)	561
Downloading and Activating a New Image (TFTP)	562
Managing Files in Internal Flash	563
Managing Files on a USB Flash Device	564
Uploading a Configuration File (SCP)	565
Managing Configuration Scripts (SFTP)	566
SCP Server	567
File and Image Management Configuration Examples	568
Upgrading the Firmware	568
Managing Configuration Scripts	571
Managing Files by Using the USB Flash Drive	573
DHCP and USB Auto-Configuration	575
Auto Configuration Overview	575
What Is USB Auto Configuration?	576
What Files Does USB Auto Configuration Use?	576
How Does USB Auto Configuration Use the Files on the USB Device?	577
What Is the Setup File Format?	579
What Is the DHCP Auto Configuration Process?	580
Monitoring and Completing the DHCP Auto Configuration Process	585
What Are the Dependencies for DHCP Auto Configuration?	586
Default Auto Configuration Values	588
Managing Auto Configuration (Web)	589
Auto-Install Configuration	589
Managing Auto Configuration (CLI)	590
Managing Auto Configuration	590
Auto Configuration Example	591
Enabling USB Auto Configuration and Auto Image Download	591
Enabling DHCP Auto Configuration and Auto Image Download	592
Easy Firmware Upgrade/Downgrade via USB	594
Monitoring Switch Traffic	595
Traffic Monitoring Overview	595
What is sFlow Technology?	595
What is RMON?	598
What is Port Mirroring?	599
Port Mirroring Behaviors	601
RSPAN	603
Remote Capture	604
Why is Traffic Monitoring Needed?	605
Default Traffic Monitoring Values	605
Monitoring Switch Traffic (Web)	606
sFlow Agent Summary	606
sFlow Receiver Configuration	607
sFlow Sampler Configuration	608
sFlow Poll Configuration	609
Interface Statistics	610
Etherlike Statistics	611
GVRP Statistics	612
EAP Statistics	613
Utilization Summary	614
Counter Summary	615
Switchport Statistics	616
RMON Statistics	617
RMON History Control Statistics	617