Cisco, Dell Authentication for Admins
Hello, Just looking for guidance to the easiest way to handle Privilege-level access to Dell or Cisco Network hardware, such as Routers, and switches. Currently I have freeRADIUS running for 802.1x WiFi authentication, which accesses a Kerberos database. i only need to identify a small group of Network Engineers as Admins and allow them access to the devices, but nobody else. What's the easiest way to accomplish this in freeRADIUS, or if I need to use another method? I'm not worried about command Authorization at the moment, although that would be a "nice to have". Thanks! -brconflict
Hi,
Just looking for guidance to the easiest way to handle Privilege-level access to Dell or Cisco Network hardware, such as
use RADIUS for authentication - FreeRADIUS will do the work.... it depends on what accounting etc you want. each vendor has their own VSA list for this sort of purpose....and you'll want to create groups and probably hunt-groups etc so only your admin group can log into the devices...along with ACLs etc so they can only get access to the admin interface from particular VLANs - TACACS+ is an alternative method (FreeRADIUS doesnt do TACACS+ yet) alan
Thanks for the input. Do you know of any specific examples? My background was with TACACS+ on Cisco ACS, so this is relatively new to me in this case. I'm getting quickly familiar, just wanted to save a little time. Thanks again! On Thu, Jul 19, 2012 at 3:56 PM, alan buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
Just looking for guidance to the easiest way to handle Privilege-level access to Dell or Cisco Network hardware, such as
use RADIUS for authentication - FreeRADIUS will do the work.... it depends on what accounting etc you want. each vendor has their own VSA list for this sort of purpose....and you'll want to create groups and probably hunt-groups etc so only your admin group can log into the devices...along with ACLs etc so they can only get access to the admin interface from particular VLANs - TACACS+ is an alternative method (FreeRADIUS doesnt do TACACS+ yet)
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
Thanks for the input. Do you know of any specific examples? My background was with TACACS+ on Cisco ACS, so this is relatively new to me in this case. I'm getting quickly familiar, just wanted to save a little time.
just follow the Cisco or Dell docs. if you run the FR in debug mode you'll see the queries come through and how they are dealt with. alan
participants (2)
-
alan buxey -
brain conflict