Enabling Cli Or Asdm Authentication - Cisco 7604 Configuration Manual

Chapter 23 Configuring Management Access
AAA for System Administrators

Enabling CLI or ASDM Authentication

To authenticate users who access the CLI or ASDM, enter the following command:
hostname(config)# aaa authentication {telnet | ssh | http} console {LOCAL |
server_group [LOCAL]}
The telnet keyword enables authentication for Telnet sessions, and when you configure this command
in the admin context, for sessioning from the switch to the FWSM.
The ssh keyword enables authentication for SSH sessions.
The http keyword authenticates the ASDM client that accesses the FWSM using HTTPS.
If you use a TACACS+ or RADIUS server group for authentication, you can configure the FWSM to use
the local database as a fallback method if the AAA server is unavailable. Specify the server group name
followed by LOCAL (LOCAL is case sensitive). We recommend that you use the same username and
password in the local database as the AAA server because the FWSM prompt does not give any
indication which method is being used.
You can alternatively use the local database as your main method of authentication (with no fallback) by
entering LOCAL alone.
For example, to enable authentication for sessions from the switch to the FWSM system execution space,
enter the following commands starting from the switch CLI:
(for an FWSM in slot 1)
Router# session slot 1 processor 1
The default escape character is Ctrl-^, then x.
You can also type 'exit' at the remote prompt to end the session
Trying 127.0.0.41 ... Open
User Access Verification
(the default login password)
Password: cisco
Type help or '?' for a list of available commands.
hostname> enable
hostname# configure terminal
(change from the system execution space to the admin
hostname(config)# changeto context admin
context called "admin")
(adds a server group called RADS)
hostname/admin (config)# aaa-server RADS protocol radius
hostname/admin (config-aaa-server-group)# aaa-server RADS (mgmt) host 192.168.1.4 cisco
(adds a RADIUS server to the RADS server group)
hostname/admin (config-aaa-server-group)# exit
(enables Telnet
hostname/admin (config)# aaa authentication telnet console RADS
authentication using the RADS server group)
The next time you session from the switch to the FWSM, you are prompted for a username and password
defined on the RADIUS server:
Router# session slot 1 processor 1
The default escape character is Ctrl-^, then x.
You can also type 'exit' at the remote prompt to end the session
Trying 127.0.0.41 ... Open
User Access Verification
Username: myRADIUSusername
Password: myRADIUSpassword
Type help or '?' for a list of available commands.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
23-12
OL-20748-01