Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 126)

100

101

10-8

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 10 Configuring AAA Servers and the Local Database

AAA Server and Local Database Support

LDAP Server Support

The security appliance can use LDAP servers for VPN authorization. When user authentication for VPN

access has succeeded and the applicable tunnel-group record specifies an LDAP authorization server

group, the security appliance queries the LDAP server and applies to the VPN session the authorizations

it receives.

Local Database Support

The security appliance maintains a local database that you can populate with user profiles.

This section contains the following topics:

• User Profiles, page 10-8

• Local Database Functions, page 10-8

• Fallback Support, page 10-9

User Profiles

User profiles contain, at a minimum, a username. Typically, a password is assigned to each username,

although passwords are optional.

The username attributes command enables you to enter the username mode. In this mode, you can add

other information to a specific user profile. The information you can add includes VPN-related

attributes, such as a VPN session timeout value.

Local Database Functions

The security appliance can use local database for the functionality described in Table 10-4.

Table 10-4 Local Database Functions

Functions Description

User authentication for CLI access When a user attempts to access the security appliance with Telnet, SSH, HTTP, or a

serial console connection and the traffic matches an authentication statement, the

security appliance challenges the user for a username and password, checks these

credentials against the local database, and grants or denies user CLI access based on

the result.

User authentication for the enable or

When a user attempts to access the enable command, the security appliance

challenges the user for a password, checks the username and password against the

local database, and grants or denies user access to enable mode based on the result.

User authorization for management

commands.

When a user authenticates with the enable command (or logs in with the login

command), the security appliance places that user in the privilege level defined by the

local database. You can configure each command to belong to privilege level between

0 and 15 on the security appliance.

User authentication for network

access

When a user attempts to access networks through the security appliance and the

traffic matches an authentication statement, the security appliance challenges the user

for a username and password, checks these credentials against the local database, and

grants or denies user network access based on the result.

1 2 ... 121 122 123 124 125 126 127 128 129 130 131 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 126

Kommentare zu diesen Handbüchern