一.测试拓扑
二.基本配置
R1:
interface FastEthernet0/0
ip address 100.1.1.1 255.255.255.0
no shut
三.R1创建cli-view
A.启用AAA
aaa new-model
--不能用如下的线下保护,不能有none
aaa authentication login noacs line none
line con 0
login authentication noacs
line vty 0 4
login authentication noacs
B.设定enable密码
enable secret cisco
C.进入root view,创建view,并设定view可以执行的命令
R1#enable view
Password:
R1#
*Mar 1 00:28:11.447: %PARSER-6-VIEW_SWITCH: successfully set to view 'root'.
parser view secop-view
secret cisco
commands exec include show access-lists
commands exec include configure terminal
commands configure include ip access-list extended
commands ipenacl include all deny
commands ipenacl include all permit
不需要ACS就可以进行测试:
R1#enable view secop-view
Password:
R1#sh
*Mar 1 00:39:19.611: %PARSER-6-VIEW_SWITCH: successfully set to view 'secop-view'.
R1#?
Exec commands:
configure Enter configuration mode
credential load the credential info from file system
enable Turn on privileged commands
exit Exit from the EXEC
show Show running system information
R1#
四.R1配置认证授权方式
A.设定radius或者tacacs服务器:
radius-server host 100.1.1.100 key cisco
或者
tacacs-server host 100.1.1.100 key cisco
B.设置认证授权方式:
aaa authentication login acsradius group radius
aaa authorization exec acsradius group radius
或者:
aaa authentication login acstacas group tacacs+
aaa authorization exec acstacas group tacacs+
C.在vty线路调用认证和授权方式:
line vty 0 4
login authentication acsradius
authorization exec acsradius
或者:
line vty 0 4
login authentication acstacas
authorization exec acstacas
五.ACS配置
A.添加认证客户端:
当添加radius client端的时候,Authenticate Using需要选择RADIUS(Cisco IOS/PIX 6.0)才会在user 或者group选项里看到关于av-pair的设置。
谢谢ozeds的博文:http://ozeds666.blog.51cto.com/2221129/941278
B.添加用户并进行授权关联
如果为radius认证和授权,需要设定用户的[009\001] cisco-av-pair属性
shell:cli-view-name=secop-view
如果为tacacs+认证和授权,需要勾选为tacacs+ settings的shell(exec)和custom attiributes,内容为cli-view-name=secop-view
---custom attiributes如果没有需要到interface configure->TACACS+ (Cisco)->Advanced Configuration Options勾上:
Display a window for each service selected in which you can enter customized TACACS+ attributes
C.通过acs服务器telnet进行认证测试