You can configure the switch to authenticate users logging into the system
for management access using local or authentication-server methods.
Remote Authentication Dial-in User Service (RADIUS) and Terminal Access Controller
Access Control System Plus (TACACS+) are logon authentication protocols that
use software running on a central server to control access to RADIUS-aware or
TACACS+-aware devices on the network. An authentication server contains a database
of multiple user name/password pairs with associated privilege levels for each
user or group that require management access to a switch.
Use this command to define the login authentication method and precedence.
Use the no form to restore the default.
Syntax
authentication login {[local] [radius] [tacacs]} no authentication login
local - Use local authentication.
radius - Use RADIUS server authentication.
tacacs - Use TACACS+ server authentication.
Default Setting
Local only
Command Mode
Global Configuration
Command Usage
RADIUS uses UDP while TACACS+ uses TCP. UDP only offers best effort delivery,
while TCP offers a connection-oriented transport. Also, note that RADIUS encrypts
only the password in the access-request packet from the client to the server.
RADIUS and TACACS+ logon authentication can control management access via
the console port, a Web browser, or Telnet. These access options must be configured
on the authentication server.
RADIUS and TACACS+ logon authentication assigns a specific privilege level
for each user name and password pair. The user name, password, and privilege
level must be configured on the authentication server.
You can specify three authentication methods in a single command to indicate
the authentication sequence. For example, if you enter “authentication
login radius tacacs local,” the user name and password on the RADIUS
server is verified first. If the RADIUS server is not available, then authentication
is attempted on the TACACS+ server. If the TACACS+ server is not available,
the local user name and password is checked.
If you are using only a RADIUS server for authentication, you need to configure
a special user name on the server for the CLI enable command that allows
access to the Privileged Exec level from the Normal Exec level. The user name
to configure on the RADIUS server for this command is "$Enable."
Use this command to display current settings for the RADIUS server.
Default Setting
None
Command Mode
Privileged Exec
Example
Console#showradius-server
Server IP address: 10.1.0.99
Communication key with radius server: solvent
Server port number: 1812
Retransmit times: 2
Request timeout: 5 Console#
Use this command to display current settings for the TACACS+ server.
Default Setting
None
Command Mode
Privileged Exec
Example
Console#show tacacs-server
Remote TACACS server configuration:
Server IP address: 10.11.12.13
Communication key with radius server: green
Server port number: 49
Console#
