Cisco PIX 525 Especificaciones descargar pdf (Pagina 311)

9-9

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 9 Accessing and Monitoring PIX Firewall

Command Authorization and LOCAL User Authentication

To create the tacacs_server_tag, use the aaa-server command, as follows:

aaa-server tacacs_server_tag [(if_name)] host ip_address [key] [timeout seconds]

Use the tacacs_server_tag parameter to identify the TACACS+ server and use the if_name parameter if

you need to specifically identify the PIX

Firewall interface connected to the TACACS+ server. Replace

ip_address with the IP address of the TACACS+ server. Replace the optional key parameter with a

keyword of up to 127 characters (including special characters but excluding spaces) to use for encrypting

data exchanged with the TACACS+ server. This value must match the keyword used on the TACACS+

server. Replace seconds with a number up to 30 that determines how long the PIX

Firewall waits before

retrying the connection to the TACACS+ server. The default value is 5 seconds.

The PIX Firewall only expands the command and the command modifier (show, clear, no) when it sends

these to the TACACS+ server. The command arguments are not expanded.

For effective operation, it is a good idea to permit the following basic commands on the AAA server:

• show curpriv

• show version

• show aaa

• enable

• disable

• quit

• exit

• login

• logout

• help

For Cisco PIX Device Manager (PDM) to work with Command Authorization using a TACACS+ Server,

the AAA server administrator should authorize the user for the following commands:

• write terminal or show running-config

• show pdm

• show version

• show curpriv

Recovering from Lockout

If you get locked out because of a mistake in configuring Command Authorization, you can usually

recover access by simply restarting the PIX

Firewall from the configuration that is saved in Flash

memory.

If you have already saved your configuration and you find that you configured authentication using the

LOCAL database but did not configure any usernames, you have created a lockout problem. You can also

encounter a lockout problem by configuring command authorization using a TACACS+ server if the

TACACS+ server is unavailable, down or misconfigured.

If you cannot recover access to the PIX Firewall by restarting your PIX Firewall, use your web browser

to access the following website:

http://www.cisco.com/warp/customer/110/34.shtml

1 2 ... 306 307 308 309 310 311 312 313 314 315 316 ... 465 466

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 311

Comentarios a estos manuales

Relacionado con productos y manuales para Los Sistemas De Control De Acceso De Seguridad Cisco PIX 525