Filter
Top Products
4-21
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Chapter 4 Setting Up the Sensor
Configuring Authentication and User Parameters
Configuring Local or RADIUS Authentication
Caution Make sure you have a RADIUS server already configured before you configure RADIUS authentication
on the sensor. IPS has been tested with CiscoSecure ACS 4.2 and 5.1 servers. Refer to your RADIUS
server documentation for information on how to set up a RADIUS server.
Note Enabling RADIUS authentication on the sensor does not disconnect already established connections.
RADIUS authentication is only enforced for new connections to the sensor. Existing CLI, IDM, and IME
connections remain established with the login credentials used prior to configuring RADIUS
authentication. To force disconnection of these established connections, you must reset the sensor after
RADIUS is configured.
To configure local or RADIUS AAA authentication on the sensor, follow these steps:
Step 1 Log in to the CLI using an account with administrator privileges.
Step 2 Enter configuration mode.
sensor# configure terminal
Step 3 Enter AAA submode.
sensor(config)# service aaa
sensor(config-aaa)#
Step 4 Configure local authentication. To continue to create users on the local system, enter yes to save your
configuration, and use the username command in configure terminal mode. To configure AAA RADIUS
authentication, go to Step 5.
sensor(config-aaa)# aaa local
sensor(config-aaa)# exit
Apply Changes?[yes]:yes
Step 5 Configure AAA RADIUS authentication:
a. Enter RADIUS authentication submode.
sensor(config-aaa)# aaa radius
sensor(config-aaa-rad)#
b. Enter the Network Access ID. The NAS-ID is an identifier that clients send to servers to
communicate the type of service they are attempting to authenticate. The value can be no nas-id,
cisco-ips, or a NAS-ID already configured on the RADIUS server. The default is cisco-ips.
sensor(config-aaa-rad)# nas-id cisco-ips
sensor(config-aaa-rad)#
c. (Optional) Configure a default user role if you are not configuring a Cisco av pair. You can configure
a default user role on the sensor that is only applied when there is NOT a Cisco av pair specifying
the user role. The values are unspecified, viewer, operator, or administrator. The default is
unspecified.
sensor(config-aaa-rad)# default-user-role operator
sensor(config-aaa-rad)#
Note Service cannot be the default role.