The following sample output shows that a TACACS+ user profile has been applied and that AAA double authentication has been
secured by an absolute timeout.
Remote Host Authentication
The following example shows how to allow the remote host to be authenticated by the local host during the first-stage authentication
and provides the remote host authorization profile.
user = aaapbx2
chap = cleartext Cisco
pap = cleartext cisco
login = cleartext cisco
service = ppp protocol = lcp
idletime = 3000
timeout = 3
service = ppp protocol = ip
inacl#1="permit tcp any any eq telnet"
service = ppp protocol = ipx
Using the access-profile Command Without Any Arguments
Using the
access-profile command without any arguments causes the removal of any access lists that are found in the old configuration (both per-user
and per-interface) and ensures that the new profile contains only access-list definitions.
user = broker_default
login = cleartext Cisco
chap = cleartext "cisco"
service = exec
autocmd = "access-profile"
! This is the autocommand that executes when broker_default logs in.
timeout = 6
service = ppp protocol = lcp
timeout = 6
service = ppp protocol = ip
! Put access lists, static routes, and other requirements that are
! needed here. Read the software specifications for details. If you leave
! this blank, the user will have no access lists (not even the ones that were
! installed prior to the creation of this user profile)!
inacl#1="permit tcp any any"
inacl#2="permit icmp host 10.0.0.0 any"
service = ppp protocol = ipx
! Put access lists, static routes, and other requirements that are
! needed here. Read the software specifications for details. If you leave
! this blank, the user will have no access lists (not even the ones that were
! installed prior to the creation of this user profile)!
Using the access-profile Command with the merge Keyword
The
merge keyword in the
access-profile command is used to remove all old access lists, and any attribute-value (AV) pair is allowed to be uploaded and installed.
The use of the
merge keyword will allow for the uploading of any custom static routes, Service Advertisement Protocol (SAP) filters, and other
requirements that users may need in their profiles. Configure the
merge keyword with care because it leaves everything open in terms of conflicting configurations.
user = broker_merge
login = cleartext Cisco
chap = cleartext "cisco"
service = exec
autocmd = "access-profile merge"
! This is the autocommand that executes when broker_merge logs in.
timeout = 6
service = ppp protocol = lcp
timeout = 6
service = ppp protocol = ip
! Put access lists, static routes, and other requirements that are
! needed here. Read the software specifications for details. If you leave
! this blank, the user will have no access lists (not even the ones that were
! installed prior to the creation of this user profile)!
route#1="10.4.0.0 255.0.0.0"
route#2="10.5.0.0 255.0.0.0"
route#3="10.6.0.0 255.0.0.0"
inacl#5="permit tcp any any"
inacl#6="permit icmp host 10.60.0.0 any"
service = ppp protocol = ipx
! Put access lists, static routes, and other requirements that are
! needed here. Read the software specifications for details. If you leave
! this blank, the user will have no access lists (not even the ones that were
! installed prior to the creation of this user profile)!
Using the access-profile Command with the replace Keyword
If you use the
access-profile command with the
replace keyword, any old configurations are removed and a new configuration is installed.
Note |
When the
access-profile command is configured, the new configuration is checked for address pools and address-AV pairs. Because addresses cannot
be renegotiated at this point, the command will fail to work when it encounters such an address-AV pair.
|
user = broker_replace
login = cleartext Cisco
chap = cleartext "cisco"
service = exec
autocmd = "access-profile replace"
! This is the autocommand that executes when broker_replace logs in.
timeout = 6
service = ppp protocol = lcp
timeout = 6
service = ppp protocol = ip
! Put access lists, static routes, and other requirements that are
! needed here. Read the software specifications for details. If you leave
! this blank, the user will have no access lists (not even the ones that were
! installed prior to the creation of this user profile)!
route#1="10.7.0.0 255.0.0.0"
route#2="10.8.0.0 255.0.0.0"
route#3="10.9.0.0 255.0.0.0"
inacl#4="permit tcp any any"
service = ppp protocol = ipx
! Put access lists, static routes, and other requirements that are
! needed here. Read the software specifications for details. If you leave
! this blank, the user will have no access lists (not even the ones that were
! installed prior to the creation of this user profile)!
Note |
The Timeout configuration in a TACACS+ user profile is different from the configuration in a RADIUS user profile. In a RADIUS
profile, only one session-timeout is configured, along with the autocommand
access-profile . The timeout will be applied to the EXEC session and to the PPP session. In the TACACS+ user profile, however, the timeout
must be configured under the service types “exec” and “ppp” (LCP) to apply a timeout to the EXEC session and to the PPP session
respectively. If the timeout is configured only under the service type “ppp,” the timeout value will not be available during
an EXEC authorization, and the timeout will not be applied to the EXEC session.
|
Feedback