3-26
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 3 Setting Up the Sensor
Configuring Authentication and User Parameters
Step 10
Exit AAA mode.
sensor(config-aaa-rad)# exit
sensor(config-aaa)# exit
Apply Changes:?[yes]:
Step 11
Press Enter to apply the changes or enter
no
to discard them.
For More Information
•
For the procedure for adding and removing users, see Adding and Removing Users, page 3-18.
•
For the procedure for configuring passwords, see Configuring Passwords, page 3- 29.
•
For the procedure for specifying password requirements, see Configuring the Password Policy,
page 3-32.
•
For detailed information on RADIUS and the service account, see The Service Account and
RADIUS Authentication, page 3-29.
Configuring Packet Command Restriction
Use the permit-packet-logging command to restrict the use of packet capture-related
commands—packet capture/display and IP logging—for local and AAA RADIUS users. The default is
to permit packet capture/display and IP log commands. Local users with the correct permissions can use
the packet capture/display and IP log commands. AAA RADIUS users with the correct av-pair can use
the packet capture/display and IP log commands.
Note
IP log actions configured for signatures are not impacted by the packet command restriction feature.
When you modify the packet command restriction option, you receive the following warning:
Modified packet settings would take effect only for new sessions, existing sessions will
continue with previous settings.
The following options apply:
•
permit-packet-logging true—Allows users to execute packet-related commands based on privilege
level.
•
permit-packet-logging false—Restricts all users from executing any packet-related commands.
AAA RADIUS Users
AAA RADIUS users with the correct av-pair are authorized to execute packet capture/display and IP
logging commands. RADIUS users with no av-pair value are restricted. The correct av-pair,
permit-packet-logging=true, allows users to execute packet-related commands based on privilege
level. This av-pair is in addition to the authentication role related av-pair:
•
ips-role=viewer
•
ips-role=operator
•
ips-role=administrator
•
ips-role=service