Re: Default Authentication

[Norman Zhang <norman.zhang@gmail.com>]

Alan DeKok wrote:
>   If you want only groups A and B to log in, do:
>
> DEFAULT Group == A, Auth-Type = System
> 	...
>
> DEFAULT Group == B, Auth-Type = System
> 	...
>
> DEFAULT Auth-Type := Reject

Thanks. Here's what I done.

DEFAULT Group == router-ro, Auth-Type = System
	Service-Type = NAS-Prompt-User,
	cisco-avpair := "shell:priv-lvl=7"

DEFAULT Group == router-rw, Auth-Type = System
	Service-Type = NAS-Prompt-User,
	cisco-avpair := "shell:priv-lvl=15"

but I can't get restriction for another group "fw-group" to work.

*added to users*
DEFAULT Group == fw-group, Auth-Type = System
        Huntgroup-Name == "fw-pix",
        Service-Type = NAS-Prompt-User,
        cisco-avpair := "shell:priv-lvl=15"

*added to huntgroups*
fw-pix NAS-IP-Address == 10.0.0.1
fw-pix NAS-IP-Address == 10.0.0.2

Group "router-ro" and "router-rw" still can login to the PIX. Can you 
give me few more pointers?

Norman