Cisco Catalyst 6500 Series User Manual

12-14
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide
OL-6392-01
Chapter 12 Configuring AAA
Configuring Command Authorization
When configuring command authorization with a TACACS+ server, do not save your configuration until
you are sure it works the way you want. If you get locked out because of a mistake, you can usually
recover access by restarting the FWSM. If you still get locked out, see the “Recovering from a Lockout”
section on page 12-19.
Be sure that your TACACS+ system is completely stable and reliable. The necessary level of reliability
typically requires that you have a fully redundant TACACS+ server system and fully redundant
connectivity to the FWSM. For example, in your TACACS+ server pool, include one server connected
to interface 1, and another to interface 2. You can also configure local command authorization as a
fallback method if the TACACS+ server is unavailable. In this case, you need to configure local users
and command privilege levels according to the “Configuring Local Command Authorization” section on
page 12-10.
This section includes the following topics:
• TACACS+ Command Authorization Prerequisites, page 12-14
• Configuring Commands on the TACACS+ Server, page 12-14
• Enabling TACACS+ Command Authorization, page 12-17
TACACS+ Command Authorization Prerequisites
Complete the following tasks as part of your command authorization configuration:
• Configure CLI authentication. (See the “Configuring Authentication for CLI Access” section on
page 12-8.)
• Configure enable authentication. (See the “Configuring Authentication to Access Privileged Mode”
section on page 12-8.)
Configuring Commands on the TACACS+ Server
You can configure commands on a CiscoSecure Access Control Server (ACS) TACACS+ server as a
shared profile component, for a group, or for individual users. For third-party TACACS+ servers, see
your server documentation for more information about command authorization support.
See the following guidelines for configuring commands on a CiscoSecure ACS TACACS+ server
Version 3.1; many of these guidelines also apply to third-party servers:
• The FWSM sends the commands to be authorized as “shell” commands, so configure the commands
on the TACACS+ server as shell commands.
Note The Cisco Secure ACS server might include a command type called “pix-shell.” Do not use this
type for FWSM command authorization.
• The first word of the command is considered to be the main command. All additional words are
considered to be arguments, which need to be preceded by permit or deny.
For example, to allow show aaa, aaa authentication, and aaa authorization command commands,
add aaa to the command box, and type permit authentication and permit authorization command
in the arguments box. The show aaa command must be listed separately. (See Figure 12-1 and
Figure 12-2.)

Cisco Catalyst 6500 Series Specifications

General

Brand	Cisco
Model	Catalyst 6500 Series
Category	Switch
Language	English