Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 442)

25-28

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 25 Configuring Tunnel Groups, Group Policies, and Users

Configuring Users

The following table describes the meaning of the keywords and variables used in this command.

By default, VPN users that you add with this command have no attributes or group policy association.

You must configure all values explicitly.

The following example shows how to configure a user named “anyuser” with a n encrypted password of

pw_12345678 and a privilege level of 12:

hostname(config)# username anyuser password pw_12345678 encrypted privilege 12

Configuring User Attributes

After configuring the user’s password (if any) and privilege level, you set the other attributes. These can

be in any order. To remove any attribute-value pair, enter the no form of the command.

Step 1 Enter username mode by entering the username command with the attributes keyword:

hostname(config)# username

name

attributes

hostname(config-username)#

The prompt changes to indicate the new mode. You can now configure the attributes.

Step 2 Specify the name of the group policy from which this user inherits attributes. By default, VPN users have

no group policy association.

hostname(config-username)# vpn-group-policy

group-policy-name

hostname(config-username)# no vpn-group-policy

group-policy-name

Using this command lets users inherit attributes that you have not configured at the username level.

You can override the value of an attribute in a group policy for a particular user by configuring it in

username mode, if that attribute is available in username mode.

The following example shows how to configure a user named “anyuser” to use attributes from the group

policy named “FirstGroup”:

hostname(config)# username anyuser attributes

hostname(config-username)# vpn-group-policy FirstGroup

Step 3 Associate the hours that this user is allowed to access the system by specifying the name of a configured

time-range policy:

To remove the attribute from the running configuration, enter the no form of this command. This option

allows inheritance of a time-range value from another group policy. To prevent inheriting a value, enter

the vpn-access-hours none command. The default is unrestricted access.

hostname(config-username)# vpn-access-hours value {time-range | none}

hostname(config-username)# vpn-access-hours value none

encrypted Indicates that the password is encrypted.

name Provides the name of the user.

nopassword Indicates that this user needs no password.

password password Indicates that this user has a password, and provides the password.

privilege priv_level Sets a privilege level for this user. The range is from 0 to 15, with lower

numbers having less ability to use commands and administer the security

appliance. The default privilege level is 2. The typical privilege level for a

system administrator is 15.

1 2 ... 437 438 439 440 441 442 443 444 445 446 447 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 442

Kommentare zu diesen Handbüchern