3-22
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 3 Setting Up the Sensor
Configuring Authentication and User Parameters
•
primary-server—Lets you configure the main RADIUS server:
–
server-address—IP address of the RADIUS server.
–
server-port—Port of the RADIUS server. If not specified, the default RADIUS port is used.
–
timeout (seconds)—Specifies the number of seconds the sensor waits for a response from a
RADIUS server before it considers the server to be unresponsive.
–
shared-secret—The secret value configured on the RADIUS server. You must obtain the secret
value of the RADIUS server to enter with the shared-secret command.
Note
You must have the same secret value configured on both the RADIUS server and the IPS
sensor so that the server can authenticate the requests of the client and the client can
authenticate the responses of the server.
•
secondary-server {enabled | disabled}— (Optional) Lets you configure a secondary RADIUS
server:
–
server-address—IP address of the RADIUS server.
–
server-port—Port of the RADIUS server. If not specified, the default RADIUS port is used.
–
timeout (seconds)—Specifies the number of seconds the sensor waits for a response from a
RADIUS server before it considers the server to be unresponsive.
–
shared-secret—The secret value configured on the RADIUS server. You must obtain the secret
value of the RADIUS server to enter with the shared-secret command.
Note
You must have the same secret value configured on both the RADIUS server and the IPS
sensor so that the server can authenticate the requests of the client and the client can
authenticate the responses of the server.
•
console-authentication—Lets you choose how users connected through the console port are
authenticated:
–
local—Users connected through the console port are authenticated through local user accounts.
–
radius-and-local—Users connected through the console port are authentica ted through
RADIUS first. If RADIUS fails, local authentication is attempted. This is the default.
–
radius—Users connected through the console p ort are authenticated by RADIUS. If you also
have local-fallback enabled, users can also be authenticated through the local user accounts.
Configuring Local or RADIUS Authentication
Caution
Make sure you have a RADIUS server already configured before you configure RADIUS authentication
on the sensor. IPS has been tested with CiscoSecure ACS 4.2 and 5.1 servers. Refer to your RA DIUS
server documentation for information on how to set up a RADIUS server.