Cisco PIX 525 Especificaciones descargar pdf (Pagina 127)

10-9

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 10 Configuring AAA Servers and the Local Database

Configuring the Local Database

Fallback Support

With the exception of fallback for network access authentication, the local database can act as a fallback

method for the functions in Table 10-4. This behavior is designed to help you prevent accidental lockout

from the security appliance.

For users who need fallback support, we recommend that their usernames and passwords in the local

database match their usernames and passwords in the AAA servers. This provides transparent fallback

support. Because the user cannot determine whether a AAA server or the local database is providing the

service, using usernames and passwords on AAA servers that are different than the usernames and

passwords in the local database means that the user cannot be certain which username and password

should be given.

The local database supports the following fallback functions:

• Console and enable password authentication—When you use the aaa authentication console

command, you can add the LOCAL keyword after the AAA server group tag. If the servers in the

group all are unavailable, the security appliance uses the local database to authenticate

administrative access. This can include enable password authentication, too.

• Command authorization—When you use the aaa authorization command command, you can

add the LOCAL keyword after the AAA server group tag. If the TACACS+ servers in the group all

are unavailable, the local database is used to authorize commands based on privilege levels.

• VPN authentication and authorization—VPN authentication and authorization are supported to

enable remote access to the security appliance if AAA servers that normally support these VPN

services are unavailable. The authentication-server-group command, available in tunnel-group

general attributes mode, lets you specify the LOCAL keyword when you are configuring attributes

of a tunnel group. When VPN client of an administrator specifies a tunnel group configured to

fallback to the local database, the VPN tunnel can be established even if the AAA server group is

unavailable, provided that the local database is configured with the necessary attributes.

Configuring the Local Database

This section describes how to manage users in the local database. You can use the local database for

CLI access authentication, privileged mode authentication, command authorization, network access

authentication, and VPN authentication and authorization. You cannot use the local database for network

access authorization. The local database does not support accounting.

For multiple context mode, you can configure usernames in the system execution space to provide

individual logins using the login command; however, you cannot configure any aaa commands in the

system execution space.

VPN authentication When a user attempts to establish VPN access and the traffic matches an

authentication statement, the security appliance checks the username and password

received against the local user database, and grants or denies VPN access based on

the result.

VPN authorization When user authentication for VPN access has succeeded, the security appliance

applies to the VPN session the attributes from the local database that are associated

with the username and the applicable group policy.

Table 10-4 Local Database Functions (continued)

Functions Description

1 2 ... 122 123 124 125 126 127 128 129 130 131 132 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 127

Comentarios a estos manuales