通过ACS4.1测试Radius和Tacas方式的CLI Views授权

一.测试拓扑

 

二.基本配置
R1：
interface FastEthernet0/0
 ip address 100.1.1.1 255.255.255.0
 no shut

三.R1创建cli-view
A.启用AAA
aaa new-model
--不能用如下的线下保护，不能有none
aaa authentication login noacs line none
line con 0
 login authentication noacs
line vty 0 4
 login authentication noacs
B.设定enable密码
enable secret cisco
C.进入root view，创建view，并设定view可以执行的命令

R1#enable view
Password:

R1#
*Mar  1 00:28:11.447: %PARSER-6-VIEW_SWITCH: successfully set to view 'root'.

parser view secop-view
 secret cisco
 commands exec include show access-lists
 commands exec include configure terminal
 commands configure include ip access-list extended
 commands ipenacl include all deny
 commands ipenacl include all permit

不需要ACS就可以进行测试：
R1#enable view secop-view
Password:

R1#sh
*Mar  1 00:39:19.611: %PARSER-6-VIEW_SWITCH: successfully set to view 'secop-view'.
R1#?  
Exec commands:
  configure   Enter configuration mode
  credential  load the credential info from file system
  enable      Turn on privileged commands
  exit        Exit from the EXEC
  show        Show running system information

R1#

四.R1配置认证授权方式
A.设定radius或者tacacs服务器：
radius-server host 100.1.1.100 key cisco
或者
tacacs-server host 100.1.1.100 key cisco
B.设置认证授权方式：
aaa authentication login acsradius group radius
aaa authorization exec acsradius group radius
或者：
aaa authentication login acstacas group tacacs+
aaa authorization exec acstacas group tacacs+
C.在vty线路调用认证和授权方式：
line vty 0 4
 login authentication acsradius
 authorization exec acsradius
或者：
line vty 0 4
 login authentication acstacas
 authorization exec acstacas

五.ACS配置
A.添加认证客户端：
当添加radius client端的时候，Authenticate Using需要选择RADIUS(Cisco IOS/PIX 6.0）才会在user 或者group选项里看到关于av-pair的设置。
谢谢ozeds的博文：http://ozeds666.blog.51cto.com/2221129/941278
B.添加用户并进行授权关联
如果为radius认证和授权，需要设定用户的[009\001] cisco-av-pair属性
shell:cli-view-name=secop-view
如果为tacacs+认证和授权，需要勾选为tacacs+ settings的shell（exec）和custom attiributes，内容为cli-view-name=secop-view

---custom attiributes如果没有需要到interface configure->TACACS+ (Cisco)->Advanced Configuration Options勾上：
Display a window for each service selected in which you can enter customized TACACS+ attributes
 
C.通过acs服务器telnet进行认证测试