Vty Line And Access-Class Configuration; Vty Line Local Authentication And Authorization - Dell Force10 C150 Configuration Manual

VTY Line and Access-Class Configuration

Various methods are available to restrict VTY access in FTOS. These depend on which authentication
scheme you use — line, local, or remote:
Table 45-1. VTY Access
Authentication Method
Line
Local
TACACS+
RADIUS
FTOS provides several ways to configure access classes for VTY lines, including:
• VTY Line Local Authentication and Authorization on page 948
• VTY Line Remote Authentication and Authorization on page 949

VTY Line Local Authentication and Authorization

FTOS retrieves the access class from the local database. To use this feature:
1. Create a username
2. Enter a password
3. Assign an access class
4. Enter a privilege level
Line authentication can be assigned on a per-VTY basis; it is a simple password authentication, using an
access-class as authorization.
Local authentication is configured globally. You configure access classes on a per-user basis.
FTOS can assign different access classes to different users by username. Until users attempt to log in,
FTOS does not know if they will be assigned a VTY line. This means that incoming users always see a
login prompt even if you have excluded them from the VTY line with a
identify themselves, FTOS retrieves the access class from the local database and applies it. (FTOS also
subsequently can close the connection if a user is denied access).
Figure 45-16
if they cannot login. No access class is configured for the VTY line. It defaults from the local database.
948 | Security
VTY access-class
support?
YES
NO
YES
YES
shows how to allow or deny a Telnet connection to a user. Users will see a login prompt, even
Username
access-class
support?
NO
YES
NO
NO
Remote authorization support?
NO
NO
YES (with FTOS 5.2.1.0 and later)
YES (with FTOS 6.1.1.0 and later)
deny-all
access class. Once users