Defining the AAA Server
Use the configuration mode aaa-server commands to specify AAA server groups. AAA server
groups are defined by a tag name. If the first authentication server defined in
the group fails, AAA fails over to the next server in the tag group. There can
be up to 14 tag groups, and each group can have up to 14 AAA servers, for a
total of up to 196 AAA servers.
Creating a Server Group (Optional)
The following command creates a server group, assigns a name
(server_tag) to the group, and—most important—specifies
which protocol is used by the group. Use the clear aaa-server
command to remove a named server group. The syntax is
Pix(config)# aaa-server server_tag
protocol [tacacs+ | radius]
Pix(config)# clear
aaa-server server_tag
This command is optional because three default server groups are
defined on the PIX Firewall in v6.2 that can be used. The show
aaa-server command shows the default groups. Pix(config)# show aaa-server
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
Pix(config)#
Notice the group name (tag) is nothing more than the protocol
name. This provides backward compatibility to older OS versions. Another group
should only be created if several AAA servers exist and it would help to keep
their functions straight. The LOCAL group was added in version 6.2, and can be
used for authentication and command authorization. This new feature is covered
in the next
section.
The following output shows creating separate TACACS+ server groups
for inbound and outbound traffic, plus a RADIUS group for accounting functions.
The server tags are up to the administrator, but should be descriptive. The
server tags are case sensitive. Pix(config)# aaa-server TacIn protocol tacacs+
Pix(config)# aaa-server TacOut protocol tacacs+
Pix(config)# aaa-server RadAcctg protocol radius
The remaining AAA commands use the group tag to identify
which group of servers will perform the AAA function.
Defining the
Server Group
The next command defines the connecting PIX interface,
server IP address, an optional encryption key shared with the AAA server, and an
optional retransmit timer. The default interface is (inside). If more than one
server is defined in the group, they’ll be used in order of entry. This command
doesn’t verify the existence of the server(s). Use the no form of the command to
remove the server from the group. The syntax is
Pix(config)# aaa-server server_tag
[(if_name)] host server_ip [key] [timeout seconds]
Pix(config)# no aaa-server server_tag [(if_name)] host server_ip [key]
[timeout seconds]
|
Note |
The server_tag is case sensitive. The
way you type it here determines how it must be addressed in future AAA commands.
If you type one of the default groups TACACS+ or RADIUS in any other case, then
you create a new server group using the default protocol tacacs+. |
This example tries to demonstrate this case importance. The first
command, show aaa-server, displays the
default groups. Lines 5 and 6 show an attempt to assign a server to each of the
default server groups (TACACS+ and RADIUS). The next show
aaa-server command reveals that two new groups were created and they both
use the tacacs+ protocol.
Pix(config)# show aaa-server
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
Pix(config)# aaa-server tacacs+ (inside) host 192.168.1.3 3key timeout 20
Pix(config)# aaa-server radius host 192.168.1.4 4key
Pix(config)# show aaa-server
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server tacacs+ protocol tacacs+
aaa-server tacacs+ (inside) host 192.168.1.3 3key timeout 20
aaa-server radius protocol tacacs+
aaa-server radius (inside) host 192.168.1.4 4key timeout 10
Pix(config)# The following example creates the RadIn and TacOut server groups
and defines two inside servers to each. From the previous example, you know Line
1 is necessary, but Line 4 could be omitted.
Pix(config)# aaa-server RadIn protocol radius
Pix(config)# aaa-server RadIn (inside) host 192.168.1.5 5key timeout 10
Pix(config)# aaa-server RadIn (inside) host 192.168.1.6 6key
Pix(config)# aaa-server TacOut protocol tacacs+
Pix(config)# aaa-server TacOut host 192.168.1.7 7key timeout 20
Pix(config)# aaa-server TacOut host 192.168.1.8 8key
158 times read
|
|
|
Did you enjoy this article?
(total 0 votes)
|
Sections
Comments (0 posted)
Syndication
