HP 6120XG HP ProCurve Series 6120 Blade Switches Access Security Guide - Page 148

TACACS+ Authentication Overview Overview Feature view the switch's authentication configuration view the switch's TACACS+ server contact configuration configure the switch's authentication methods Default n/a n/a Menu - - disabled - configure the switch to contact TACACS+ server(s) disabled - CLI Web page 4-9 - page - 4-10 page - 4-11 page - 4-18 TACACS+ authentication enables you to use a central server to allow or deny access to the switches covered in this guide (and other TACACS-aware devices) in your network. This means that you can use a central database to create multiple unique username/password sets with associated privilege levels for use by individuals who have reason to access the switch from either the switch's console port (local access) or Telnet (remote access). A3 or B3 A4 A1 Primary TACACS+ Server A2 or B2 B1 The switch passes the login requests from terminals A and B to the TACACS+ server for authentication. The TACACS+ server determines whether to allow access to the switch and what privilege level to allow for a given access request. Switch Configured for A TACACS+ Operation Terminal "A" Directly Accessing the Switch Via Switch's Console Port B4 B Access Request TACACS Server Response Terminal "B" Remotely Accessing The Switch Via Telnet A1 - A4: Path for Request from Terminal A (Through Console Port) B1 - B4: Path for Request from Terminal B (Through Telnet) Figure 4-1. Example of TACACS+ Operation TACACS+ in the switches covered in this guide manages authentication of logon attempts through either the Console port or Telnet. TACACS+ uses an authentication hierarchy consisting of (1) remote passwords assigned in a TACACS+ server and (2) local passwords configured on the switch. That is, with TACACS+ configured, the switch first tries to contact a designated 4-2