Cisco Cisco Access Registrar 4.2 Spécifications télécharger pdf (Page 188)

5-4

Cisco Wireless LAN Controller Configuration Guide

OL-13826-01

Chapter 5 Configuring Security Solutions

Configuring TACACS+

Integrated Security Solutions

• Cisco UWN Solution operating system security is built around a robust 802.1X AAA (authorization,

authentication and accounting) engine, which allows operators to rapidly configure and enforce a

variety of security policies across the Cisco UWN Solution.

• The controllers and lightweight access points are equipped with system-wide authentication and

authorization protocols across all ports and interfaces, maximizing system security.

• Operating system security policies are assigned to individual WLANs, and lightweight access points

simultaneously broadcast all (up to 16) configured WLANs. This can eliminate the need for

additional access points, which can increase interference and degrade system throughput.

• Operating system security uses the RRM function to continually monitor the air space for

interference and security breaches, and notify the operator when they are detected.

• Operating system security works with industry-standard authorization, authentication, and

accounting (AAA) servers, making system integration simple and easy.

Configuring TACACS+

Terminal Access Controller Access Control System Plus (TACACS+) is a client/server protocol that

provides centralized security for users attempting to gain management access to a controller. It serves as

a backend database similar to local and RADIUS. However, local and RADIUS provide only

authentication support and limited authorization support while TACACS+ provides three services:

• Authentication—The process of verifying users when they attempt to log into the controller.

Users must enter a valid username and password in order for the controller to authenticate users to

the TACACS+ server. The authentication and authorization services are tied to one another. For

example, if authentication is performed using the local or RADIUS database, then authorization

would use the permissions associated with the user in the local or RADIUS database (which are

read-only, read-write, and lobby-admin) and not use TACACS+. Similarly, when authentication is

performed using TACACS+, authorization is tied to TACACS+.

Note When multiple databases are configured, you can use the controller GUI or CLI to specify

the sequence in which the backend databases should be tried.

• Authorization—The process of determining the actions that users are allowed to take on the

controller based on their level of access.

For TACACS+, authorization is based on privilege (or role) rather than specific actions. The

available roles correspond to the seven menu options on the controller GUI: MONITOR, WLAN,

CONTROLLER, WIRELESS, SECURITY, MANAGEMENT, and COMMANDS. An additional

role, LOBBY, is available for users who require only lobby ambassador privileges. The roles to

which users are assigned are configured on the TACACS+ server. Users can be authorized for one

or more roles. The minimum authorization is MONITOR only, and the maximum is ALL, which

authorizes the user to execute the functionality associated with all seven menu options. For example,

a user who is assigned the role of SECURITY can make changes to any items appearing on the

Security menu (or designated as security commands in the case of the CLI). If users are not

authorized for a particular role (such as WLAN), they can still access that menu option in read-only

mode (or the associated CLI show commands). If the TACACS+ authorization server becomes

unreachable or unable to authorize, users are unable to log into the controller.

1 2 ... 183 184 185 186 187 188 189 190 191 192 193 ... 635 636

Commentaires sur ces manuels

Pas de commentaire

Cisco Cisco Access Registrar 4.2 Spécifications Page 188

Commentaires sur ces manuels