IBM Partner Pavilion BMD00082 manual TACACS+ Authentication Features, Authorization

SmartConnect User’s Guide

TACACS+ Authentication

The switch supports authentication and authorization with networks using the Cisco Systems TACACS+ protocol. The switch functions as the Network Access Server (NAS) by interacting with the remote client and initiating authentication and authorization sessions with the TACACS+ access server. The remote user is defined as someone requiring management access to the switch either through a data or management port.

TACACS+ Authentication Features

Authentication is the action of determining the identity of a user, and is generally done when the user first attempts to log in to a device or gain access to its services. The switch supports ASCII inbound login to the device. PAP, CHAP and ARAP login methods, TACACS+ change password requests, and one-time password authentication are not supported.

Authorization

Authorization is the action of determining a user’s privileges on the device, and usually takes place after authentication.

The mapping between TACACS+ authorization levels and switch management access levels is shown in Table 6-4 on page 74. The authorization levels must be defined on the TACACS+ server.

Table 6-4SmartConnect-Proprietary Attributes for TACACS+

User Access Level TACACS+ level

user0

oper3

admin6

Configuring TACACS+ Authentication

1.On the BBI, choose System Settings > Remote User Administration to configure TACACS+ authentication.

2.In the Tacacs+ section of the window, enter the Tacacs+ Primary Server IP address and TACACS+ Secret.

3.Select enable for the Tacacs+ option.

4.Click Apply to make your changes active, and Save to retain changes beyond reboot.

74 „ Chapter 6: Configuring Switch Access BMD00082, February 2009