Filter
Top Products
3-23
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 3 Setting Up the Sensor
Configuring Authentication and User Parameters
Note
Enabling RADIUS authentication on the sensor does not disconnect already established connections.
RADIUS authentication is only enforced for new connections to the sensor. Existing CLI, IDM, and IME
connections remain established with the login credentials used prior to configuring RADIUS
authentication. To force disconnection of these established connections, you must reset the sensor after
RADIUS is configured.
To configure local or RADIUS AAA authentication on the sensor, follow these steps:
Step 1
Log in to the CLI using an account with administrator privileges.
Step 2
Enter configuration mode.
sensor# configure terminal
Step 3
Enter AAA submode.
sensor(config)# service aaa
sensor(config-aaa)#
Step 4
Configure local authentication. To continue to create users on the local system, enter
yes
to save your
configuration, and use the username command in configure terminal mode. To configure AAA RADIUS
authentication, go to Step 5.
sensor(config-aaa)# aaa local
sensor(config-aaa)# exit
Apply Changes?[yes]:yes
Step 5
Configure AAA RADIUS authentication:
a.
Enter RADIUS authentication submode.
sensor(config-aaa)# aaa radius
sensor(config-aaa-rad)#
b.
Enter the Network Access ID. The NAS-ID is an identifier that clients send to servers to
communicate the type of service they are attempting to authenticate. The value can be no nas-id,
cisco-ips, or a NAS-ID already configured on the RADIUS server. The default is cisco-ips.
sensor(config-aaa-rad)# nas-id cisco-ips
sensor(config-aaa-rad)#
c.
(Optional) Configure a default user role if you are not configuring a Cisco av pair. You can configure
a default user role on the sensor that is only applied when there is NOT a Cisco av pair specifying
the user role. The values are unspecified, viewer, operator, or administrator. The default is
unspecified.
sensor(config-aaa-rad)# default-user-role operator
sensor(config-aaa-rad)#
Note
Service cannot be the default role.
d.
Configure a Cisco av pair. If you do not want to configure a default user role on the sensor that is
applied in the absence of a Cisco av pair, you need to configure the Cisco IOS/PIX 6.x RADIUS
Attributes [009\001] cisco-av-pair under the group or user profile with one of the following options:
–
ips-role=viewer
–
ips-role=operator