中兴ACS服务器软件,AAA基本配置：终于成功完成了真实的ACS4.1与模拟PIX软件的交互 实验成功...

ACS配置的几个要点：1、在接口配置拦目中选择相应的项目，否则不会在其他拦目中显示出来

2、在设备端的示例

ACS认证(authentication)：路由器方式和PIX不同

Step1>在设备端定义tacacs+服务器地址以及key

tacacs-server host 202.101.110.110

tacacs-server directed-request

tacacs-server key test

Step2>在ACS端定义设备的IP地址

Step3>在ACS上面建立用户名和用户组

Step4>在设备端配置AAA认证

aaa new-model

aaa authentication login default group tacacs+ local

aaa authentication enable default group tacacs+ enable

line vty 0 4

login authentication default

授权、记帐：

aaa new-model

aaa authorization commands 1 default group tacacs+ local

aaa authorization commands 15 default group tacacs+ local

line vty 0 4

authorization commands 1 default

authorization commands 15 default

aaa accounting exec default start-stop group tacacs+

lin vty 0 4

accounting exec default

如果要记录用户所用的命令，设备端配置为：

aaa new-model

aaa accounting commands 0 default start-stop group tacacs+

aaa accounting commands 1 default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

line vty 0 4

accounting commands 0 default

accounting commands 1 default

accounting commands 15 default

一、AAA服务器配置：PIX/ASA方式Chicago(config)# username admin password cisco

Chicago(config)# aaa-server mygroup protocol radius

Chicago(config-aaa-server)# max-failed-attempts 4

Chicago(config-aaa-server)# reactivation-mode depletion deadtime 5

Chicago(config-aaa-server)# exitChicago(config)# aaa-server mygroup host 172.18.124.11

Chicago(config-aaa-server)# retry-interval 3

Chicago(config-aaa-server)# timeout 30

Chicago(config-aaa-server)# key cisco123

Ch