|
|
This chapter explains the function and syntax of the authentication commands. For more information about defaults and usage guidelines, see the corresponding chapter of the Cisco IOS Security Command Reference, Release 12.1.
Syntax Description
default Uses the listed methods that follow this argument as the default list of methods when a user logs in. list-name Character string used to name the following list of authentication methods tried when a user logs in. method1 [method2...] At least one of the keywords described in Table 32.
Table 32 lists aaa authentication arap methods.
| Keyword | Description |
|---|---|
guest | Allows guest logins. This method must be the first method listed, but it can be followed by other methods if it does not succeed. |
auth-guest | Allows guest logins only if the user has already logged in to EXEC. This method must be the first method listed, but can be followed by other methods if it does not succeed. |
line | Uses the line password for authentication. |
local | Uses the local username database for authentication. |
local-case | Uses case-sensitive local username authentication. |
group radius | Uses the list of all RADIUS servers for authentication. |
group tacacs+ | Uses the list of all TACACS+ servers for authentication. |
group group-name | Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the aaa group server radius or aaa group server tacacs+ command. |
Syntax Description
d The delimiting character at the beginning and end of the string that notifies the system that the string is to be displayed as the banner. The delimiting character can be any character in the extended ASCII character set, but once defined as the delimiter, that character cannot be used in the text string making up the banner. string Any group of characters, excluding the one used as the delimiter. The maximum number of characters that you can display is 2996.
Syntax Description
method1 [method2...] At least one of the keywords described in Table 33.
Table 33 lists aaa authentication emable default methods.
| Keyword | Description |
|---|---|
enable | Uses the enable password for authentication. |
line | Uses the line password for authentication. |
none | Uses no authentication. |
group radius | Uses the list of all RADIUS servers for authentication. |
group tacacs+ | Uses the list of all TACACS+ servers for authentication. |
group group-name | Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the aaa group server radius or aaa group server tacacs+ command. |
Syntax Description
d The delimiting character at the beginning and end of the string that notifies the system that the string is to be displayed as the banner. The delimiting character can be any character in the extended ASCII character set, but once defined as the delimiter, that character cannot be used in the text string making up the banner. string Any group of characters, excluding the one used as the delimiter. The maximum number of characters that you can display is 2996.
Syntax Description
default Uses the listed authentication methods that follow this argument as the default list of methods when a user logs in. list-name Character string used to name the list of authentication methods activated when a user logs in. method1 [method2...] At least one of the keywords described in Table 34.
Table 34 lists aaa authentication login methods.
| Keyword | Description |
|---|---|
enable | Uses the enable password for authentication. |
krb5 | Uses Kerberos 5 for authentication. |
krb5-telnet | Uses Kerberos 5 Telnet authentication protocol when using Telnet to connect to the router. |
line | Uses the line password for authentication. |
local | Uses the local username database for authentication. |
local-case | Uses case-sensitive local username authentication. |
none | Uses no authentication. |
group radius | Uses the list of all RADIUS servers for authentication. |
group tacacs+ | Uses the list of all TACACS+ servers for authentication. |
group group-name | Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the aaa group server radius or aaa group server tacacs+ command. |
Syntax Description
default Makes the listed authentication methods that follow this argument the default list of methods used when a user logs in. list-name Character string used to name the list of authentication methods activated when a user logs in. method1 [method2...] At least one of the methods described in Table 35.
Table 35 lists aaa authentication nasi methods.
| Keyword | Description |
|---|---|
enable | Uses the enable password for authentication. |
line | Uses the line password for authentication. |
local | Uses the local username database for authentication. |
local-case | Uses case-sensitive local username authentication. |
none | Uses no authentication. |
group radius | Uses the list of all RADIUS servers for authentication. |
group tacacs+ | Uses the list of all TACACS+ servers for authentication. |
group group-name | Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the aaa group server radius or aaa group server tacacs+ command. |
Syntax Description
text-string String of text that will be displayed when the user is prompted to enter a password. If this text-string contains spaces or unusual characters, it must be enclosed in double-quotes (for example, "Enter your password:").
Syntax Description
default Uses the listed authentication methods that follow this argument as the default list of methods when a user logs in. list-name Character string used to name the list of authentication methods tried when a user logs in. method1 [method2...] At least one of the keywords described in Table 36.
Table 36 lists aaa authentication ppp methods.
| Keyword | Description |
|---|---|
if-needed | Does not authenticate if user has already been authenticated on a TTY line. |
krb5 | Uses Kerberos 5 for authentication (can only be used for PAP authentication). |
local | Uses the local username database for authentication. |
local-case | Uses case-sensitive local username authentication. |
none | Uses no authentication. |
group radius | Uses the list of all RADIUS servers for authentication. |
group tacacs+ | Uses the list of all TACACS+ servers for authentication. |
group group-name | Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the aaa group server radius or aaa group server tacacs+ command. |
Syntax Description
text-string String of text that will be displayed when the user is prompted to enter a username. If this text-string contains spaces or unusual characters, it must be enclosed in double-quotes (for example, "Enter your name:").
To map a Dialed Number Information Service (DNIS) number to a particular authentication server group (this server group will be used for AAA authentication), use the aaa dnis map authentication ppp group command in global configuration mode. To remove the DNIS number from the defined server group, use the no form of this command.
aaa dnis map dnis-number authentication ppp group server-group-name
Syntax Description
dnis-number Number of the DNIS. server-group-name Character string used to name a group of security servers associated in a server group.
Syntax Description
This command has no arguments or keywords.
Syntax Description
number Specifies the number of background processes allocated for AAA requests for PPP. Valid entries are 1 to 2147483647.
Syntax Description
merge (Optional) Like the default form of the command, this option removes existing ACLs while retaining other existing authorization attributes for the interface. However, using this option also installs per-user authorization attributes in addition to the existing attributes. (The default form of the command installs only new ACLs.) The per-user authorization attributes come from all AV pairs defined in the AAA per-user configuration (the user's authorization profile). The interface's resulting authorization attributes are a combination of the previous and new configurations. replace (Optional) This option removes existing ACLs and all other existing authorization attributes for the interface. A complete new authorization configuration is then installed, using all AV pairs defined in the AAA per-user configuration. This option is not normally recommended because it initially deletes all existing configuration, including static routes. This could be detrimental if the new user profile does not reinstall appropriate static routes and other critical information. ignore-sanity-checks (Optional) Enables you to use any AV pairs, whether or not they are valid.
 |
Caution If you use a list-name value that was not configured with the aaa authentication arap command, ARA protocol will be disabled on this line. |
Syntax Description
default Default list created with the aaa authentication arap command. list-name Indicated list created with the aaa authentication arap command. one-time (Optional) Accepts the username and password in the username field.
To clear the list of remote hosts for which automated double authentication has been attempted, use the clear ip trigger-authentication command in privileged EXEC mode.
clear ip trigger-authenticationSyntax Description
This command has no arguments or keywords.
Syntax Description
timeout seconds (Optional) Specifies how frequently the local device sends a UDP packet to the remote host to request the user's username and password (or PIN). The default is 90 seconds. port number (Optional) Specifies the UDP port to which the local router should send the UPD packet requesting the user's username and password (or PIN). The default is port 7500.
Syntax Description
This command has no arguments or keywords.
Syntax Description
default Uses the default list created with the aaa authentication login command. list-name Uses the indicated list created with the aaa authentication login command.
Syntax Description
default Uses the default list created with the aaa authentication nasi command. list-name Uses the list created with the aaa authentication nasi command.
Syntax Description
protocol1 [protocol2...] Specify at least one of the keywords described in Table 37. if-needed (Optional) Used with TACACS and extended TACACS. Does not perform CHAP or PAP authentication if the user has already provided authentication. This option is available only on asynchronous interfaces. list-name (Optional) Used with AAA. Specifies the name of a list of methods of authentication to use. If no list name is specified, the system uses the default. The list is created with the aaa authentication ppp command. default (Optional) The name of the method list is created with the aaa authentication ppp command. callin (Optional) Specifies authentication on incoming (received) calls only. one-time (Optional) Accepts the username and password in the username field.
Table 37 lists the protocols used to negotiate PPP authentication.
chap | Enables CHAP on a serial interface. |
|---|---|
ms-chap | Enables Microsoft's version of CHAP (MS-CHAP) on a serial interface. |
pap | Enables PAP on a serial interface. |
Syntax Description
hostname The name sent in the CHAP challenge.
Syntax Description
secret The secret used to compute the response value for any CHAP challenge from an unknown peer.
Syntax Description
callin (Optional) This keyword specifies that the router will refuse to answer CHAP authentication challenges received from the peer, but will still require the peer to answer any CHAP challenges the router sends.
Syntax Description
secret The secret used to compute the response value for any CHAP challenge from an unknown peer.
ppp pap sent-username username password password
no ppp pap sent-username
Syntax Description
username Username sent in the PAP authentication request. password Password sent in the PAP authentication request. password Must contain from 1 to 25 uppercase and lowercase alphanumeric characters.
To view the list of remote hosts for which automated double authentication has been attempted, use the show ip trigger-authentication command in privileged EXEC mode.
show ip trigger-authenticationSyntax Description
This command has no arguments or keywords.
Syntax Description
This command has no arguments or keywords.
Syntax Description
seconds Integer that determines the number of seconds the system will wait for login input before timing out. Available settings are from 1 to 300 seconds.
Posted: Wed Jul 26 16:08:16 PDT 2000
Copyright 1989-2000©Cisco Systems Inc.